Implementing authentication

What you'll learn

• Why programs need authentication before giving access to data or features.
• How an ID and password can be checked using a lookup.
• How to design the logic for a simple login system.
• How to write Python 3 code that implements authentication.

Why authentication is needed

Many computer systems should not let just anyone use them. For example, a school network account, online banking app, or email account should only be accessible to the correct user.

Authentication helps to:

• protect private data
• stop unauthorised users changing or deleting information
• make sure actions can be linked to the correct user account
• restrict access to systems, files, or services

A very common way to authenticate a user is to ask for two pieces of information:

• an ID, often called a username
• a password, which should be known only by that user

The basic idea: ID and password

A login system usually stores a list of valid user IDs and their matching passwords. When someone tries to log in, the program compares the entered details with the stored details.

A simple stored user table might look like this:

In this example, the ID bob belongs with the password B5c6D7e8.

Lookup

To authenticate a user, the program needs to search stored data and find the entry for the entered ID.

For GCSE programming, a dictionary in Python is a good way to represent this.

For authentication:

• the key can be the user ID
• the value can be the stored password

Example:

users = {
    "alice": "A1b2C3d4",
    "bob": "B5c6D7e8",
    "carol": "C9d0E1f2"
}

Here, "bob" is a key. The value stored with it is "B5c6D7e8".

The authentication algorithm

A simple authentication algorithm follows this logic:

1. Ask the user to enter their ID.
2. Ask the user to enter their password.
3. Look up the ID in the stored user table.
4. If the ID is not found, reject the login.
5. If the ID is found, compare the entered password with the stored password for that ID.
6. If they match, allow access.
7. If they do not match, reject the login.

This flowchart shows the key decision points in an ID-and-password authentication system.

Writing the program in Python

Here is a simple Python 3 program that implements authentication using an ID and password lookup.

users = {
    "alice": "A1b2C3d4",
    "bob": "B5c6D7e8",
    "carol": "C9d0E1f2"
}

user_id = input("Enter ID: ")
password = input("Enter password: ")

if user_id in users:
    if password == users[user_id]:
        print("Access granted")
    else:
        print("Access denied")
else:
    print("Access denied")

The line:

if user_id in users:

checks whether the entered ID exists as a key in the dictionary.

The line:

password == users[user_id]

compares the entered password with the password stored for that particular ID.

Using a function

In a larger program, authentication is often written as a function. A function is a named block of code that can be reused.

def authenticate(user_id, password, users):
    if user_id in users:
        return password == users[user_id]
    else:
        return False

users = {
    "alice": "A1b2C3d4",
    "bob": "B5c6D7e8",
    "carol": "C9d0E1f2"
}

entered_id = input("Enter ID: ")
entered_password = input("Enter password: ")

if authenticate(entered_id, entered_password, users):
    print("Access granted")
else:
    print("Access denied")

This version separates the login decision from the input and output. That makes the program easier to test and reuse.

Exact matching matters

Passwords are usually checked using exact string comparison.

That means:

• uppercase and lowercase letters are different
• spaces count as characters
• every character must be in the same order

For example, these are all different strings:

• Password1
• password1
• Password1

The last one has a space at the end.

Handling missing IDs safely

A program should not try to look up a password for an ID that does not exist.

This would be unsafe in Python:

if password == users[user_id]:
    print("Access granted")

If user_id is not in the dictionary, the program can crash because there is no stored value to retrieve.

That is why the safer version checks the ID first:

if user_id in users:
    if password == users[user_id]:
        print("Access granted")

Input validation is not the same as authentication

You may also see checks on the input before authentication, such as making sure the ID and password are not blank.

For example:

if entered_id == "" or entered_password == "":
    print("ID and password must both be entered")
else:
    if authenticate(entered_id, entered_password, users):
        print("Access granted")
    else:
        print("Access denied")

This is useful, but it is not enough on its own.

A password being present only means the user typed something. Authentication checks whether it is the correct password for that ID.