Fightpandemics: An unlogged user should not access profile information(email,FB,etc) of another user through the user profile, from a post on View Board

[sheeba1]

summary/Issue: An unlogged user can access profile information(email,FB,etc) of another user through the user profile, from a post on View Board.

Unlogged in users should be required to log in to view profiles.

[galeza]

@vikjoshi
Please prioritise.

[vikjoshi]

Hmm yeah this is something we hadn’t thought about. @indirabhowmick @manualzuru do you think we should just not allow non logged in users to see the profile pages of the users/orgs? Should be addressed in Release 1 though

[joshmorel]

@vsan626 @jpmitri - please pause working on this for now.

@sheeba1 cc @emtay I think we should close this OR we need at least more details how this scenario should be handled (more below).

I initially created this to allow access to all based on this discussion https://fightpandemics.slack.com/archives/C014JQYVB89/p1592923444017100 . We are hiding the most sensitive things (email, address if they choose to). Couldn't find anything on Slack which is follow up to @vikjoshi 's question (if you know let us know).

There was a proposed feature pod "Privacy & Visibility Settings" that was not quite prioritized for the MVP wide launch but should definitely be in the pipeline. This is where we could add this option - this is what it is Facebook where you can't view a user's profile if not logged in:

IF we were to do this now - blanket for all users (no setting):

1. On BE change backend GET /user/:id to authenticate instead of authenticateOptional
2. On FE if visiting user profile directly & BE returns 401 (authenticate decorator will do this) instead show 404 page
3. On FE feed in the post header where you can click to visit the profile link - if logged off then make it redirect to log-in similar to how we have with "View More"*

With a setting like Facebook I would make it authenticateOptional and if they choose the option then throw a 401 error in step 1 (but we'd need to update our forms and model - not a good idea since we have higher priority items to deliver).

*Note for feed post "View More" link we redirect them to log-in/sign-up to encourage them to do so. Non-logged in users & crawlers can & need to be able to visit the post directly by URL.

An issue that could be worked on for now - let's use our nice 404 page on not found profile/organisation instead of this ugly error message (I will create):

[emtay]

@joshmorel @manualzuru i don’t think unlogged in users should see profiles. We don’t even let them see a full post if not logged in- and without more privacy settings it seems risky to let profiles be accessed outside the platform.

This option seems right:

On FE feed in the post header where you can click to visit the profile link - if logged off then make it redirect to log-in similar to how we have with "View More"*

[jpmitri]

let me see if i understood this right you want us to redirect them to the log in page if they try to access a post and after they log in should i redirect them to that post or just let logging page redirect them to where it normally dose?

[emtay]

No, that’s an example of how we want the redirect to work.

What I’m proposing for this story is:

Given user Is logged in
When user clicks on profile of another user
Then they see the other profile

Given user Is NOT logged in
When user clicks on profile of another user
Then they will be redirected to login and
Given they then log in, they’ll proceed to other user‘s profile (their original intention)

[joshmorel]

@emtay as mentioned earlier the posts redirect is not about privacy it's about trying to get a user to sign up.

But I'm on board for profiles until we have more specific privacy settings. Is individual users only not orgs or is it both?

But @jpmitri don't worry about posts for this one as it's already handled. It's the profile link we're interested in here.

[emtay]

Per conversation with @joshmorel and @manualzuru :

1: Individual profiles require users to be logged in
2: Organization profiles can be viewed by logged in or not logged in

AC for individual profile:
Given user Is logged in
When user clicks on profile of another individual user
Then they see the other profile

Given user Is NOT logged in
When user clicks on profile of another individual user
Then they will be redirected to login and
Given they then log in, they’ll proceed to other user‘s individual profile (their original intention)

AC for organization profile:
Given user Is logged in
When user clicks on profile of another organization user
Then they see the organization profile

Given user Is NOT logged in
When user clicks on profile of another organization user
Then they see the organization profile

[sheeba1]

@joshmorel , shall I leave it open as the requirements have been defined as above.

[emtay]

@sheeba1 @joshmorel I think we're aligned and can move forward- correct?

@emtay , I am good. Thanks!

@jpmitri or @vsan626 - which of you were taking this?

[vsan626]

@emtay we were pair programming on this

[joshmorel]

@emtay @vsan626 @jpmitri I think there was one issue with my suggestion for backend but I see with both open tickets - they are front end only? I guess I could do the backend as I have in my mind how to handle this.

I think it would be better to return 404 if the user is not logged in and visits the profile. This is what Facebook does for example above.

Once we have privacy settings on the profile, they'd be added to the User.find query so it would be 404 and we could handle it similarly on the FE as a non-existent profile. For now I could add temporary code to throw 404 if !user within backend (i.e. added during optionalAuthenticate if logged in).

[joshmorel]

We can use this for now - at line 125 of backend/lib/endpoints/users.js . You can add to #1482 instead of me opening new PR. I will take a review of frontend code after other questions are resolved.

      // Temporary code to return 404 if requesting user not logged in
      // eventually will be determined based on user privacy settings
      if (authUserId === null) {
        throw app.httpErrors.notFound();
      }