Opinion on example.com/username with Routes

Question

I'm setting up a site where users have their own "profile". I'm using routes for neat URLs and I wondered what are the pros/cons to the following:

example.com/:username

Or should I include a static route to filter that it's a profile page request?

example.com/u/:username
example.com/something-static/:username

Which is best?

Answer 1

I don't think you'd want

example.com/:username

as that would put restrictions on the usernames available so as not to clash with other paths under the url.

I would propose

profiles.example.com/:username

Answer 2

If it is possible for the user to specify their username and customize their profile page in a significant way, then you run the risk of enabling fraud/phishing attacks.

For example, I could register with a username of "passwordreset", and then put a form (or a link to a form) on my profile page, and then try to persuade people that they need to reset their passwords by visiting example.com/passwordreset.

Then I could harvest the passwords.

If the URL was example.com/users/passwordreset, there is more chance that an alert user would become suspicious.