As with any high level question such as this one, the answer will largely depend on your requirements.
The first question I should ask though (since it was not specified in your question) is why are you concerned with a subdomain or subfolder at all? Will these be for "vanity" URLs? If not and you are only serving up content based on a user logging in, then you would only need your base URL (no need for a folder or subdomain). Once you authenticate a user, you will know who they are and what they should have access to and can serve up content based on their login.
If you are looking to use this for vanity URLs, then here are a few pros/cons of each:
- Better option for SEO. Search engines will see each subdomain as a separate website and will not give as much weight to the root domain. Using subfolders will help to improve SEO rankings.
- Your code will most likely have some kind of rewrite involved if you are planning to only have a single code base.
- Will still need to take into account what a user is allowed to see based on their login.
- As JamesRyan mentioned, if users are generating any code, then cookies could be a concern since they are all on the same domain.
- If you are planning to use SSL (which you should be if you have users providing passwords or other private data), then you would only need a single certificate. You can use a single wildcard certificate for subdomains, but those tend to be much more expensive.
- Better option if you are looking to create separate web sites (i.e. different webroot, different apache instance, different ssl certificate for each site, etc.)
- Wouldn't necessarily have any rewrites to take into account (although you still could). Your code could be written to check the host header to determine what content to serve up.
- Would require either a wildcard DNS record or you will need to manually create DNS records for each subdomain you create. Depending on the number of subdomains being created, this could require a lot of effort. Wildcard DNS records would for sure be the way to go.
- As with the subfolder option, if you are using the same code base to serve up each site, you still need to authenticate users and check what they are authorized to see.
At the end of the day, it really comes down to what your requirements are. I've only listed a few things to keep in mind with either option. If you would like to refine your question to be more specific I'm sure you would probably get a few more specific answers.