I have a User Authentication module in my project, that is managing all user information and is regulated with certain granular access rights as Create User, Change User and Delete User. These are obviously meant for administration uses and a regular user will not have those permission sign to.

Never the less, as a regular user I want to edit my own user details of course. With a regular user not having the Change user permission, he could exactly not do that. Of could make an exceptional condition in the back end if a user wants to edit himself. But somehow I've got the feeling, that there is a cleaner way to do this.

What would be the best way for this dilemma?


The self-edit authorization might be somewhat different from the administrator's change user. After all, an end-user might not be allowed to change his ID or his core identity (e.g. name) or the permissions that are granted to himself, but only his address or contact details and non-critical data.

If this self edit is a general rule of your system, nothing speaks against coding this exception.

But a more future proof approach would be to use a self-edit authorization, and code access using this permission. You may then either add programmatically this authorization to a user record if it's a general rule, or require it to be explicitly added by the administrator to a user-record, if there are stricter rules in the company.

  • Thanks for the answer. Yes, I really like the self-edit approach. This way it fits way better into the concept. – Herr Derb Aug 4 '17 at 11:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.