<blockquote>
<p>why not take advantage of the control panel for editing?</p>
</blockquote>
<p>In my opinion, it's not a great idea. If you have users that shouldn't access any part of the control panel except their own account settings, these users are effectively &quot;front-end users&quot;, and it's probably going to be worthwhile to implement the <a href="https://craftcms.com/knowledge-base/front-end-user-accounts#step-3-create-the-account-management-forms" rel="nofollow noreferrer">the necessary forms for front-end user management</a> in order to provide a seamless and secure user experience, rather than allowing them access to your site's admin interface.</p>
<p>But if you want pros and cons, these are the two pros I can think of:</p>
<ol>
<li>You'll save a little bit of time by not having to implement the necessary forms for front-end user management.</li>
<li>If this is Craft 5, your users will be able to use MFA. Front-end MFA support is <a href="https://github.com/craftcms/cms/pull/15452" rel="nofollow noreferrer">in the pipeline</a> for the upcoming Craft 5.5 release, though – so this will only stay a pro for a short while </li>
</ol>
<p>And as for the cons:</p>
<ol>
<li>As far as permissions go, a good rule of thumb is to never provide more access than strictly needed. By giving these users control panel access (that they don't technically need, aside from editing their account), I'd be wary of them somehow gaining additional permissions down the line – either accidentally (i.e. human error on your part, i.e. someone checks the wrong checkbox) or (perhaps less likely) via a technical bug or some kind of vulnerability. Of course, privilege escalation is always a concern, but allowing these users control panel in the first place feels like it's going to increase the risk that somehow, they might be able to access things they aren't supposed to access.</li>
</ol>
<p><em>If you trust all of your users (e.g. this is for some kind of internal application), this might not be an issue. However if this is for a site w/ public user registrations, personally I'd be very hesitant about allowing &quot;anyone&quot; access to the site's control panel.</em></p>
<ol start="2">
<li><p>Depending on your use case/target audience, not having account management seamlessly integrated in the front-end design might seem a bit off-putting/cheap/confusing in terms of user experience. I'd also say Craft's control panel isn't really designed for the use case; users might expect their account settings to be easier available than what Craft makes them, in cases where the account settings is the only thing that they log in to access.</p>
</li>
<li><p>There are a few <a href="https://craftcms.com/docs/5.x/reference/config/general.html" rel="nofollow noreferrer">config settings</a> that affect UX for account management, for example the URL users should be redirected to after being logged in or logged out. By eschewing front-end account management and allowing CP access for your front-end users, you won't be able to tailor the UX for these users and your actual authors/editor users separately.</p>
</li>
</ol>

CC BY-SA 4.0
2024-09-30T19:01:04.370Z
OK I am sold on front end branding and UX arguments. Cheers Mats
joomkit
CC BY-SA 4.0
2024-09-29T22:03:11.300Z
2024-09-29T22:09:52.247Z
2024-09-29T22:09:52.247Z
Mats Mikkel Rummelhoff
<p>I am setting up a site which will essentially in craft terms be a user directory.
Users will be able to edit their profiles.
Do I roll my own front end forms for editing?
Or why not take advantage of the control panel for editing?</p>
<p>I did a quick test of a user in a non permissioned group and they could edit their profile through the admin ok. Oddly not all widgets don't seem to have permission controls? I dont want users seeing the dashboard widgets but why not use the excellent UI thats there already for their profile?</p>

<users><user-profile>
What are the pros and cons of user profiles front end or control panel for editing?
# What are the pros and cons of user profiles front end or control panel for editing?

(Asked by: username_0 on 2024-09-29)

I am setting up a site which will essentially in craft terms be a user directory.
Users will be able to edit their profiles.
Do I roll my own front end forms for editing?
Or why not take advantage of the control panel for editing?

I did a quick test of a user in a non permissioned group and they could edit their profile through the admin ok. Oddly not all widgets don't seem to have permission controls? I dont want users seeing the dashboard widgets but why not use the excellent UI thats there already for their profile?

**Tags:** users, user-profile


---

## 1 answers

### Answer by username_1 on 2024-09-29. Score: 1 | Accepted answer

> why not take advantage of the control panel for editing?

In my opinion, it's not a great idea. If you have users that shouldn't access any part of the control panel except their own account settings, these users are effectively "front-end users", and it's probably going to be worthwhile to implement the [the necessary forms for front-end user management](https://craftcms.com/knowledge-base/front-end-user-accounts#step-3-create-the-account-management-forms) in order to provide a seamless and secure user experience, rather than allowing them access to your site's admin interface.

But if you want pros and cons, these are the two pros I can think of:

1. You'll save a little bit of time by not having to implement the necessary forms for front-end user management.
2. If this is Craft 5, your users will be able to use MFA. Front-end MFA support is [in the pipeline](https://github.com/craftcms/cms/pull/15452) for the upcoming Craft 5.5 release, though – so this will only stay a pro for a short while

And as for the cons:

1. As far as permissions go, a good rule of thumb is to never provide more access than strictly needed. By giving these users control panel access (that they don't technically need, aside from editing their account), I'd be wary of them somehow gaining additional permissions down the line – either accidentally (i.e. human error on your part, i.e. someone checks the wrong checkbox) or (perhaps less likely) via a technical bug or some kind of vulnerability. Of course, privilege escalation is always a concern, but allowing these users control panel in the first place feels like it's going to increase the risk that somehow, they might be able to access things they aren't supposed to access.

*If you trust all of your users (e.g. this is for some kind of internal application), this might not be an issue. However if this is for a site w/ public user registrations, personally I'd be very hesitant about allowing "anyone" access to the site's control panel.*

2. Depending on your use case/target audience, not having account management seamlessly integrated in the front-end design might seem a bit off-putting/cheap/confusing in terms of user experience. I'd also say Craft's control panel isn't really designed for the use case; users might expect their account settings to be easier available than what Craft makes them, in cases where the account settings is the only thing that they log in to access.
3. There are a few [config settings](https://craftcms.com/docs/5.x/reference/config/general.html) that affect UX for account management, for example the URL users should be redirected to after being logged in or logged out. By eschewing front-end account management and allowing CP access for your front-end users, you won't be able to tailor the UX for these users and your actual authors/editor users separately.

> **Comments:**
> **username_0**: OK I am sold on front end branding and UX arguments. Cheers Mats  

---

