User profile/account URLs

Question

I'm required to provide functions for both users and administrators to edit account and profile details in a web application. An example of a URL for the public side of these profiles is:

http://example.com/user/joe

I'm still torn between two ways to design these URLs. I've thought of either this:

http://example.com/user/joe/edit

Or something non-specific and separate to the profiles:

http://example.com/account

The benefit of the first one is that it allows administrators to do their job through the same functions. This avoids building a whole different backend specifically for administrators. I suppose the negative here is that I'd have to be careful with authorization and make sure nobody can edit what they are not supposed to edit.

The second is a more standard way of doing things, it'd turn out to be simpler and easier to secure, though it means a separate interface for administrative users.

What is SO's opinions on this? Are there any more pros/cons for either way? Which method would you recommend to use?

Answer 1

I would have a different view for the administrator with such a security sensitive area. It makes things much more explicit having a separate view. It is likely even an administrator would only be able to edit certain user information and thus have a different view to the user editing themselves.

It makes the authorization much clearer even if the two views shared a common edit form

Answer 2

If you are using an MVC approach, then my suggestion would be:

http://example.com/user/edit/1234

or

http://example.com/user/edit/joe

Where user is the controller, edit the controller method and 1234 or joe the user id or username respectively.

But as Gumbo commented, administrators should not be allowed to edit user information. They should have some mecanism to disable the account in case of a profile has offensive content or false info. Forcing the user to update it to get the account active again.

Answer 3

The way we do it is the admin and the user share the same view. Items which are admin-only are protected from editing or viewing by the user.

The reason for the single view is:

• It reduces the number of 'moving parts' - when a new field is added to the user screen, it only needs to be added once,
• It is easier to move items to/from the user's purview. If all of a sudden, management decides to allow a user to manage their "FizzBar" then we only need make the change in one place, and
• It is easier to segregate the roles and the functions at the controller level.

Answer 4

I think that you should go with the second approach. It's more secure and flexible, and shouldn't be harder to code than profile editing the profile inline.