1

Maybe it's a silly question, I have searched for a similar question and the most similar that I have found is this Refusing a user permission to click a URL but they are talking about showing partial information. My requirement is a little bit different.

Normally, when you are not logged in, you are redirected to the login page. In my site I have two roles. Each role has its own dashboard. For example user X is logged in and has role Y, if user X enters a url to a section of role P (a section where he does not have permissions) what is the best way to handle this? I have three options:

  1. Redirect to his (user X's) dashboard immediately without saying nothing.
  2. Show a message saying he does not have permission to view the section. Include a link to his dashboard in the message.
  3. Show the login form saying "Please log in as role P".

IMPORTANT: Users cannot register as role Y being role P and vice versa, so, I cannot invite user X to register to become other role.

Improve this question
2
  • Another option is what SharePoint does - display a message saying the user does not have permission and provide a link that will request access to that section of the site.
    – user1757436
    Dec 16 '15 at 14:27
  • 1
    I'm not clear on how your system behaves. Users register as a single role, but can obtain the other role via a third-party, and can log in as either role? And they cannot log in as both roles at the same time? Is that correct? The best interactions to provide would most likely depend on how often people hold both roles, which roles are most important, how often they "accidentally" go to the other dashboard, how often they switch roles... The goal is to minimise the time and effort spent on security functions and support interactions in the ways that feel natural to your users.
    – Steve Dodier-Lazaro
    Dec 16 '15 at 14:45
1

If they are two completely separate dashboards, and there is no backlinks in any way in role Y's dashboard that would somehow take them to role P's dashboard by accident, it's safe to assume the user's intent is to manually access role P's dashboard when they know they shouldn't be able to, in that case, I think it would be okay to just automatically redirect them back to their dashboard.

However, if there is doubt on how the user might end up on the other dashboard somehow, as in, if the user knows about role P's dashboard, and has accessed it before, it would be safe just to display a friendly message telling them they don't have permission to access this area, and give them a link back to where they were, or to their main dashboard view.

Based on your information, I would avoid using the login form option, at least solely, as you mentioned the user would have no way of signing up for that role, and you can't invite them to it, so they most likely wouldn't have a login for that section anyways, but in the slim chance that they do, you could also attach to the permission error message something like "Do you have a login for this dashboard? Click here." and take them to the login form that way, but don't display it initially.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.