This questions is related to this one : anonymous checkout
My company bought a CRM software and I am concerned by the way it stores customers' information.
The website allows anonymous users to have a shopping cart and add products. The website asks them to log in once they want to pay.
The thing is: anonymous customers are stored in the same table than authenticated customers, the only difference is: their email, password, saltkey is empty. The only information we keep is the IP address; when the user logs in we can convert this account into a real one. This table also contains a 'isAdmin' flag.
EDIT: indeed, an asp.net authentication cookie is created to maintain user session.
The question I have: is it a ok practice or is there a possible security issue with this ?
More information: we have 20k 'ghost' users in the database, a maintenance system is available to clean useless records after some time.
EDIT2: my main concerns are :
- anonymous, authenticated and admin users are in the same table
- Anonymous users are considered as authenticated users by asp.net, the CRM has its own way to detect if they are really authenticated.