Validation vs Authentication

Validation and authentication are two different checks that often guard the same login screen. Validation asks whether the data is in an acceptable form; authentication asks who the user is.

Validation checks the data

Validation tests input against rules the programmer has written, such as a presence check, a length check, a range check or a pattern check, and rejects anything that breaks them. A login form might use a presence check so neither field is blank, plus a length check so the user ID has between three and twelve characters.

Passing those rules only shows the data looks sensible. A user ID of hx24 passes a length check because it has four characters, but that tells you nothing about whether an account with that ID exists or whether the password typed beside it belongs to it.

Authentication checks the person

Authentication compares the credentials entered with the details stored for an account, then grants or refuses access to the system, its files and its features. The login only succeeds when the user ID and the password belong to the same stored account, so a valid-looking user ID paired with somebody else’s password is still refused. This is authentication by lookup, because the program searches the stored credentials for a matching pair.

The program below checks that both fields are present, then looks up the matching pair.

user_ids = ["hx24", "priya_r"]
passwords = ["cobalt9", "sunrise2"]

entered_id = input("User ID: ")
entered_password = input("Password: ")

if len(entered_id) == 0 or len(entered_password) == 0:
    print("Both fields must be completed")
else:
    granted = False
    for i in range(len(user_ids)):
        if entered_id == user_ids[i] and entered_password == passwords[i]:
            granted = True
    if granted:
        print("Access granted")
    else:
        print("Access denied")

Output when the user types hx24, cobalt9:

User ID: hx24
Password: cobalt9
Access granted