Search code examples
authenticationlogin-control

Login for admin and ordinary user


Should I have one login form for ordinary user and admin Or should I have separate login form for admin and ordinary user?


Solution

  • It is OK to have the same form.

    The purpose of the login page is authentication-- determine who the user is, not what they can do (see What is the difference between authentication and authorization?). So for example you might want them to submit a password or other token to reduce the risk that they are not the person they say they are. That can be the same process for everyone.

    Certain features in your site may be available only to administrators or end users, but checking for permissions (authorization) can only be done after you're sure who the user is (they have authenticated). And logic to check for permissions should be present on every single page. So it has little bearing on what the authentication process is like.