{"action":"opened","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/8289","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/8289/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/8289/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/8289/events","html_url":"https://github.com/yiisoft/yii2/issues/8289","id":73456623,"number":8289,"title":"How to separate Frontend & Backend to use different tables (member/admin style)","user":{"login":"WadeShuler","id":9557392,"avatar_url":"https://avatars.githubusercontent.com/u/9557392?v=3","gravatar_id":"","url":"https://api.github.com/users/WadeShuler","html_url":"https://github.com/WadeShuler","followers_url":"https://api.github.com/users/WadeShuler/followers","following_url":"https://api.github.com/users/WadeShuler/following{/other_user}","gists_url":"https://api.github.com/users/WadeShuler/gists{/gist_id}","starred_url":"https://api.github.com/users/WadeShuler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WadeShuler/subscriptions","organizations_url":"https://api.github.com/users/WadeShuler/orgs","repos_url":"https://api.github.com/users/WadeShuler/repos","events_url":"https://api.github.com/users/WadeShuler/events{/privacy}","received_events_url":"https://api.github.com/users/WadeShuler/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-05T22:57:44Z","updated_at":"2015-05-05T22:57:44Z","closed_at":null,"body":"I have setup a few Yii1 sites, and another Yii2 basic site.\r\n\r\nI am used to other systems having a \"members\" directory, with a \"members\" table (or users) and an \"admin\" directory using an \"admin\" table. I am sure many of us have seen it, and that is how I like it. I like to separate the two entirely. If there was a hole, and some malicious user was to execute things they shouldn't, they could gain access to things they shouldn't. From a security point of view, the code to do admin things shouldn't be in the same file/script that users access. This has been talked about for years, and covered by security experts.\r\n\r\nI thought Yii2 Advanced was like this. It has a frontend and backend, which looks like user and admin sections. However, the backend uses /common/models/LoginForm, which results in the same user table. It looks like any user on frontend can simply navigate to backend and be logged in?\r\n\r\nI have tried to separate them, but have found little help online about this.\r\nMy StackOverflow Question: http://stackoverflow.com/questions/30060571/yii2-advanced-make-backend-use-admin-table-and-admin-model\r\n\r\nI am needing the backend to be completely separate from frontend. A logged in user on frontend should not have access to backend. The backend should use a different table ('admin') from the frontend ('user').\r\n\r\nSince frontend uses Yii::$app->user for the frontend (users), I guess that means Yii::$app->admin for the backend (admin). I see the backend also uses Yii::$app->user, so how does it know the difference between a frontend and backend user?\r\n\r\nIf you look at my SO question, you can see that I have copied the /common/models/User model as Admin, edited the main config.. I get errors, and not sure what all I have to do to get these separated. I can't find anything in the docs to help me figure out the process. I don't have a problem copying or extending classes, I just have no idea what has to be done to pull it off. I made AdminLoginForm and referenced the Admin class instead of user, but just felt I was going further down the rabbit hole. While I do assume this would require a separate login form, I don't know if the other stuff is right (main config, Admin model, etc) so I wouldn't know if it was due to errors in other areas.\r\n\r\nIMO it should be like this out of the box, two separate sections shouldn't share the same users. Why can't the Yii2 Advanced come with an Admin section (whether it replaces backend, or it generates frontend, backend, admin) and it's own Admin model, login form, etc. We can delete it if we don't need it. It seems like it would be a very common setup that many of us would appreciate.\r\n\r\nMy guess is the logic behind it is frontend is for non-logged in users, and backend is for logged in users. Most systems need an admin section to manage those users (add/edit/delete/reset pass) at a minimum.\r\n\r\n\r\n"}}