If you have multiple products/sites under a common domain, what are the advantages and disadvantages, from user convenience to security, of having a common login page? For example, this site uses https://security.stackexchange.com/users/login for login. Google uses accounts.google.com and Microsoft uses login.live.com. However Apple doesn't have a common page, Facebook has the login form on the home page and most banks do too.

  • As with many questions, this answer starts with "it depends." What is the data class? What is the potential impact of loss of control of the login page? What is the potential impact of an individual account gaining elevated (though unauthorized) privileges? – Sean E. M. Jan 2 '20 at 21:32
  • For security, there is a minor benefit in keeping them separate. But there is an overwhelming benefit in usability for having a single sign-on, so in almost any scenario I would advise a single login. Most companies that don't, do this not out of choice but because of the difficulty in integrating separate applications, third-parties etc. – paj28 Feb 3 '20 at 16:34

From a security point of view, both have their own issues and both have their advantages. Both can be made more or less equally secure.

If you use a login-page per service, you might want to synchronize passwords, using, as an example, LDAP or something like that. Otherwise, users may need different passwords per site/service. On the other hand, if you do not synchronize passwords, you allow users to have different passwords per service.

If you use a single login page for all your services, you need a security token to allow access to different sites. There are a number of frameworks for this, so try not to re-invent the wheel.

In general, when you make a choice, you will consider at least:

  • What is the image that you want to give to the users? A single entity or just a bunch of services?
  • Are the development groups of the different services sufficiently aligned with your security-token solution?
  • Do you want to allow your users to use different passwords per service? Did you think about password-resets?
  • Even using multiple pages, couldn't they build upon a security-token approach that maintains a common password and even single sign-on? – Sushil Jan 6 '20 at 1:13
  • Sure, but why, if you are going to let them log-in again? One of the main reasons to use security tokens is that users do not need to re-authenticate themselves every time. – Ljm Dullaart Jan 6 '20 at 18:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.