The app should allow users to signup using both local login and also from other platforms like facebook or google. The Users table has a required password field. If an Users signup using the local registration form he/she will fill in the required password field. But what if the User opts to use facebook to signup to the app? In that case the required password field will not have any value to store and it will fail to register a new user. How should the Users table be designed to handle such issue?

  • If making a field mandatory prevents you from satisfying your requirements, then it can't possibly be recommended. It look like you have no choice here. – Kilian Foth Oct 27 '17 at 8:46
  • But if the password field is not required, then new users can signup without entering a password which doesn't seem right. I was curious how the sites that implement both local login system and oAuth logins design their Users table to handle this issue. – 99darshan Oct 27 '17 at 8:51
  • Your question is unclear. You say the password is not a required value, you say making the password field required cannot possibly work, then you ask whether you should make the password field required, which as you yourself said a) doesn't work and b) is wrong since the password isn't required. So, what exactly is it that you want to know? – Jörg W Mittag Oct 27 '17 at 8:52
  • just edited the question, hope it makes sense now. – 99darshan Oct 27 '17 at 9:02
  • It's not clear what's flexible in the design and what isn't. What sort of control do you have over the DB design? Are you, for example, a UI engineer with no control? Are you on a small team where you have some input? Is this homework, where the teacher sets the restraints? – outis Nov 26 '17 at 10:14

I'm going to be stating the obvious here:

  • It is recommended to make password a required field if a user is required to have a password
  • It is not recommended to make password a required field if a user is not required to have one

Users authenticating through third party services do typically not input a password for you to register, so you do not have one to store.

You could require them to input a password upon registration when they authenticate through a third party service, but personally I fail to see the point in using third party service for authentication if that's the way you deal with it.

The actual bottom line here is that in some use cases generic recommendations are not applicable, you'll have to discern the criteria and business rules in place to determine what the best approach in your case is. Perhaps you have very good reasons to require a password to be stored with you despite using third party authentication and then you should do so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.