- [Craig] In this video, we take a look at simple authentication routines.
(uplifting piano jingle)
The data used by systems needs to be kept secure and this can be achieved in a number of ways.
The most obvious is using username and passwords to prevent unauthorised access to systems.
But what if the user forgets the username and password?
There needs to be a mechanism for the user to recover a username and password,
but this mechanism needs to be secured as well.
It may be that the user has to enter their email address
and then click on a link within that email to verify they are who they say they are.
Data files should also be encrypted so the data can't just be read with simple text editors.
Online bots are able to submit data automatically to forms,
and this can be protected against using software such as reCAPTCHA that verifies a user is human.
Programmers should also be aware of the potential for SQL injection hacks
and other methods used by hackers to access data.
Now the specification states that students must understand the need for
and be able to write programs that implement authentication.
And in its clarification,
it goes on to say that this involves the simple use of ID and a password lookup.
Now there are many ways to approach this in your exams, and we're going to show you one now.
So first of all, let's start language non-specific
and just provide some basic structured English pseudocode.
So we're going to start off by storing our username and passwords in plain text, as it said,
in a 2D array or a list.
Now as I said, there's many ways you could do this.
You could choose to store the items in a file, a plain text file,
but of course, this would make your authentication routine more complex,
as you'd need to read from the file.
So let's just keep it nice and simple for now.
We're then going to set a Boolean variable called found and another one called valid to false
and also initialise other variables.
And you'll see later on with the technique that we've chosen why we've got these variables.
Obviously, found is going to be used to determine
whether a user that's entered their username is actually found,
and then valid is going to be used to check whether their password is correct or not.
Then we're going to ask someone for their username.
We're then going to enter a while loop,
and while we haven't found the username that's been entered in our array or list,
we're going to ask if the username entered matches the current one we're looking at, then.
We're going to set found equals true because we've found this user in our list of valid users,
and then we're going to ask for their password.
Again, we're now going to check that the password they've entered
matches the correct entry for the user that we're currently looking at.
And indeed, if it does,
we're going to now set valid to true.
Obviously, we'll carry on going around that while loop, checking different users,
but eventually we're going to exit the while loop, meaning we've checked every user in the array.
At this point, we can interrogate valid,
and if it's true, then we can simply output valid user.
Now obviously, in a real situation, you would then allow them to log on to your system.
In a similar way, if valid is false,
we know the user hasn't been found in the array or their password's wrong.
So we're going to output an appropriate message.
So we're going to move on from our structured English now
and actually implement this in Python so you can follow along.
We've kept the structured English in the bottom right-hand corner,
and this is a nice example of how you can lay down the logic of a problem,
and then we're going to tackle it one line at a time
and turn that into actual implemented code.
So the first thing we have to do is store the username and passwords in a 2D array or list.
Well we're using Python,
so we're using lists within a list here, effectively Python's version of 2D arrays.
And if we look here, we can see we've created a list called users.
And in there we've got Craig, that's a username,
and his password is password,
Dave, his password's secret,
and Sam, and his password is let me in.
Now first thing,
obviously, these users should be using better passwords
and obviously, in the real world, we'd be much more secure than this.
We'd be making sure those passwords were encrypted and not stored in plain text.
But for the GCSE level,
being able to write and show the logic of a simple authentication routine is all we need.
So we've done step one, we've set up three users with three passwords
and we've stored it in the list users.
We're then going to initialise those variables that we're going to use.
So we're going to say found equals false and valid equals false,
and they will remain false unless our algorithm discovers a user and a matching correct password.
We're also initialising another variable, which you'll see we're using later on to zero.
And it's always good practice to initialise any variables that you're going to use.
We then prompt the user to enter a username.
So here, we see input enter username,
and we're storing what they type in a variable called username.
So now we set up our while loop, and we want to go round this while loop
while we haven't found the username that's just been entered.
So we're saying while found equals false,
because that's the flag we're going to change if we find the user,
and while number is less than the length of the user's array.
So we're going to carry on going round this loop
until we've looked through every entry in the user's array or list,
or until we know we've found a user.
So now we start checking the first entry in the user's array or list.
So if user's number,
which is currently zero, so this is the first entry.
If user's number equals username, then we know we have found the user.
We now set found to become equal to true.
And of course, now we know that this user exists,
we input them to enter their password.
We then do a very similar line of code.
We now say if password equals user's number,
and this time it's one because we're looking in the second field across,
we already know the user exists,
but now we're checking whether the password they've entered matches.
Again, in a similar way,
if it did match, we set valid to true.
We've set found to true, meaning we found a user,
and now we've set valid to true,
meaning that the password they've entered matches.
Now of course, if either of those things aren't true,
then we're going to increment number by one
and we'll go back to the while loop,
and we'll carry on going through the array or list each entry at a time.
Eventually, we are going to exit the while loop,
and you can see from our pseudocode,
we want to say if valid is true, then say you are a valid user,
and if valid is false, then say invalid.
Now you could do that as two if statements
or like we've done here, slightly neater,
we're using an if else.
So if valid equals true, print valid user, else,
or in other words,
print invalid username or password.
Now obviously, this is a very simple authentication routine we've written here.
There are many different variations you could use,
but try not to get too complicated.
Get comfortable with one that you're happy with because, as you saw earlier on,
the specification simply states you need to be able to write a simple authentication routine.
So a quick recap then.
What is an authentication routine?
It's a piece of code which checks if someone should be allowed access to a system or program
and what level of access they should have.
You need to be able to write a simple authentication routine
that uses a username and password,
but you'll only be required to use plain text username and passwords.
You're not going to need to worry in exam conditions
about the complexities of encrypting passwords,
which of course, you would do with a real password system.
And below is the simple pseudocode that we outlined earlier in this video
for a very simple authentication routine.
So that's the theory content of the video covered.
We're just going to spend a little bit of time talking about the programming language subset.
If you've heard this before,
you can skip the rest of this video.
Otherwise, it's definitely worth a quick watch.
So the exam board Edexcel have released a document that they call the programming language subset,
which you can see here on the right.
This document specifies which parts of Python 3 are required
in order that the assessment can be undertaken with confidence.
Students familiar with everything in this document
will be able to access all parts of the paper two on-screen assessment.
The exam board will not go beyond the scope of this document
when setting you any questions in the paper two exam.
Any students who do successfully use more complex methods which are not included in the document
will still, however, be awarded marks.
Further to this, you will see here from the front of the exam paper
that you are actually going to be supplied with a printed and an electronic copy of the PLS
during your paper two exam.
Well, if this document outlines everything you need to know
in order to program in Python during the exam
and you can be guaranteed that you can answer all the questions
using all the techniques in this document for full marks,
then you might as well get used to using it now.
Ask for a copy from your teacher
and have it as a reference guide at all times throughout your GCSE course.
It will be invaluable.
(uplifting piano jingle)