Options for Handling Both SSO and Username/Password Loginġ. There's some great discussion on this topic on dev.to and Security Stack Exchange if you want to dig in more. However it's probably not worth the additional step unless you also have the SSO use case. The two-page design also makes it harder for bad actors to create phishing sites with look-alike login pages when there is a page redirect involved. For example, the site can check if the account has enabled two-factor authentication and, if not, require a CAPTCHA for login.

It also allows the platform to perform conditional security checks. The separation could make credential stuffing attacks more cumbersome. Is separating the username and password field onto different pages more secure? This post looks at the security of this design decision and presents options for designing login forms that support multiple paths of authentication. So you're not alone if you've ever wondered why the password field is missing or on another page. However, this login flow confuses people which is probably why you're reading this! Websites usually present a username and password field in the same view for us to log in. sign in with Google or a service like Okta) The most common reason to put username and password on two different pages is to support both:

Log in to pinterest with username