Decision Use `access_unpublished` for password-protected pages
acceptedSome pages need to be accessible only to specific groups or individuals using a password or token, without requiring a full user account.
Decision
Use the Access Unpublished module to grant temporary, token-based access to specific nodes. This covers use cases such as white papers behind a code, volunteer sign-up forms for a specific group, or draft content shared with reviewers before publication.
Do not use Protected Pages or custom access control solutions for this purpose.
Consequences
Access is granted via time-limited, per-node tokens that can be revoked at any time, without requiring the recipient to have a Drupal account. This keeps the solution simple and auditable.
Token URLs should be treated as sensitive and distributed carefully, as anyone with the link gains access for the duration of the token's validity.