# Usernames in admin URLs cause routing problems

**URL:** https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825
**Category:** Bug
**Created:** [2015年八月6日 11:21 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825 "2015-08-06T11:21:23Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2015年八月6日 11:21 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/1 "2015-08-06T11:21:23Z")

</div>

In some places, usernames are used as part of URLs, for example in `admin/users/<username>`. Some usernames can therefore cause routing issues:

1. Register a user `list`.
2. Login as the administrator, go to the users list, open the details for this user.
3. Notice that you are on `admin/users/list`.
4. Reload the page. You get to the list of all users, since `admin/users/list` actually matches this route.

Many other URLs like `users/account-created` are safe, since `-` cannot be part of a username.

Here, this is only a small annoyance. I’m not sure whether there are more interesting cases where a similar problem can be triggered, though.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年八月7日 02:02 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/2 "2015-08-07T02:02:43Z")

</div>

I will add `list` to the blocked usernames. Any others?

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2015年八月7日 02:05 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/3 "2015-08-07T02:05:01Z")

</div>

we really should stop with the “fancy” url thing in admin… `/admin/users/1/sam` … is a perfectly fine URL for an admin interface, plus knowing the user\_id is actually handy sometimes when it comes to admin tasks.

---

<div class="post-metadata">

### Author: ![fefrei](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fefrei/32/119538_2.png) [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [2015年八月7日 07:12 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/4 "2015-08-07T07:12:21Z")

</div>

I’m really with @sam in this case:

- So far, the blocked usernames only contain confusing usernames (that look official or unintentional), not ones that break the system.
- This list is admin-editable, nothing is preventing the admin from removing entries. This would have non-obvious side effects.
- If I understand correctly, changing the default won’t affect systems which already customized the list, for example by adding an entry.
- I have a strong feeling that there are more cases like this. I think that `account-created` is safe only by coincidence, not by careful consideration (“there could be a username here, so let’s add an invalid character…”).

Also, I don’t see the drawback: `/admin/users/1/sam` is perfectly fine for the admin’s eyes (heck, `t/usernames-in-admin-urls-cause-routing-problems/31825` is fine for everyone’s eyes!), still has the slug (which is nice), and even works as a permalink across username changes!  
It would also fix some issues for free: For example, after renaming a user, the back-functionality breaks, since the old URLS 404.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [2015年八月7日 07:17 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/5 "2015-08-07T07:17:27Z")

</div>

Yeah, but that takes potentially hours of engineering effort, whereas blacklisting a pointless username like “list” takes me about 30 seconds.

---

<div class="post-metadata">

### Author: ![fantasticfears](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/fantasticfears/32/119608_2.png) [@fantasticfears](https://meta.discourse.org/u/fantasticfears)
#### Post date: [2015年九月26日 13:54 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/6 "2015-09-26T13:54:13Z")

</div>

As working on the Unicode username support, the first step would be relaxing username constraints in routes. And I will also apply `/admin/users/1/sam` to admin routes.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2016年三月31日 01:54 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/7 "2016-03-31T01:54:18Z")

</div>

I am pretty sure @fantasticfears submitted a PR to take care of this. My admin username path is now:

`https://meta.discourse.org/admin/users/1/sam`

Yes, I am #1 just like 🇺🇸

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [2016年三月31日 01:54 UTC](https://meta.discourse.org/t/usernames-in-admin-urls-cause-routing-problems/31825/8 "2016-03-31T01:54:21Z")

</div>


