Basically, I want to create a restricted HTML front end to present and edit fields in a database. Users will have to log in with a username and password to gain access. Would you store the user login details in the same database but in a separate table, or in an entirely different database?
3 Answers
I store user information in the same database, I just create a users table that stores their username email and hashed password. Make sure to hash and salt the passwords before they are inserted into the database.
Yes, I would store the login details in the same database. That's the way most frameworks and e.g. CMS do it. Since there has to be some kind of connection to the login database to make the login work, the same security concerns would apply to seperate databases.
A separated security database may be required when you have several database applications sharing the same identification and authorization model. As you're developing the single application you can place security data in the same database (however, you can use a separated schema).
Additionally, user details and login details are in 1:M relation usually, hence two tables will be a more flexible solution. I.e. a user may have the internal login/password as well as the OpenID or other external identity.
Related