2

I was trying to figure out best practices for storing admin user's passwords and found a stack overflow suggestion to "use separate login pages for users and admin using the same DB table (to stop XSRF and session-stealing granting access to admin areas"). Up until this point I was planning on using 2 separate tables(AdminUser/User) on my password database (with salt/hash entries) that get authenticated on different sub-domains. Is there a reason why I would use the same table for both set's of hashes?

2

Is there a reason why I would use the same table for both set's of hashes?

Not really. You can use a separate table if you want. From a development perspective it might be slightly easier to use a single table (since you can re-use any stored procedures) but from a security perspective it doesn't increase or decrease your attack surface in any meaningful way. There is no harm with either decision.

Just be sure you are only storing the password hash and salt, and that you generate a new salt each time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.