diff --git a/NEWS b/NEWS
index b0f16cfc4..9923bc77f 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ Enhancements
  - [web] now also give modify permission when selecting all calendar rights
  - [web] allow edition of IMAP flags associated to mail labels
  - [web] search scope of address book is now respected
+ - [web] avoid redirection to forbidden module (via ModulesConstraints)
 
 Bug fixes
  - [core] yearly repeating events are not shown in web calendar (#4237)
diff --git a/UI/MainUI/SOGoUserHomePage.m b/UI/MainUI/SOGoUserHomePage.m
index 0d526748d..55d561437 100644
--- a/UI/MainUI/SOGoUserHomePage.m
+++ b/UI/MainUI/SOGoUserHomePage.m
@@ -1,6 +1,6 @@
 /* SOGoUserHomePage.m - this file is part of SOGo
  *
- * Copyright (C) 2007-2015 Inverse inc.
+ * Copyright (C) 2007-2017 Inverse inc.
  *
  * This file is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -76,11 +76,12 @@
   loginModule = [ud loginModule];
   if (!([loginModule isEqualToString: @"Calendar"]
         || [loginModule isEqualToString: @"Contacts"]
-        || [loginModule isEqualToString: @"Mail"]))
+        || [loginModule isEqualToString: @"Mail"])
+      || ![[context activeUser] canAccessModule: loginModule])
     {
       [self errorWithFormat: @"login module '%@' not accepted (must be"
             @"'Calendar', 'Contacts' or 'Mail')", loginModule];
-      loginModule = @"Calendar";
+      loginModule = @"Contacts";
     }
 
   // We check if we must write the Sieve scripts to the server