Use Cases & Key Limitations

Use Cases

User Accounts is suited for simple membership sites with;

• Gated pages, like;
  • Basic information and links that you only want members to see.
  • A form that you only want members to fill out.
• Gated content such as a blog, recipes or simple courses

Unsupported Use Cases

User Accounts is not suitable for;

• - User directories, like user-managed public profiles
• - Delivery of sensitive information where you need to be able to revoke someone's access quickly
• - Personalization, as in showing the user's name, photo, and info throughout your site

It is also not a foundation for any kind application, where you need to store and retrieve user-specific content;

• An auction site where people upload listings and others view and like them
• A commenting system where users can easily comment on your blog posts

Key Limitations

User Sign Up

• Users must use email and a password as their login
• SSO such as Google logins is unsupported
• Email addresses can not be changed

CMS Support

• Content gating works at the page level, which means that you can gate an entire collection ( blog, courses, etc ), but not individual items.
• There is also no ability to connect Users to CMS items, e.g. to store auction listings they upload.

Content Security

Webflow's gating approach to text content is good, as pages are gated server-side.

However, assets such as images and video are publicly accessible if you have the URL.

User Account Security

Perhaps the biggest security concern I have is around the way login tokens work.

In my initial tests ( 2023 );

All login state and access info is determined at the point of login, and then "remembered" by the browser until the access token expires, or the user logs out.

This means;

• Access group changes do not take effect until the user logs out and logs back in again.
  • This means you cannot lock someone out quickly
  • And that upgrades / downgrades do not take effect immediately
• Even if you delete the user, they'll still be logged in and have full access to the site until their JWT auth token expires, roughly 4 hours after login.
  • Even closing the browser won't log them out,  

‍