Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Dennis Lee Bieber <wlfraed@ix.netcom.com>
Newsgroups: comp.lang.python
Subject: Re: password and username code
Date: Sun, 06 Mar 2016 12:44:18 -0500
Organization: IISS Elusive Unicorn
Lines: 62
Message-ID: <mailman.259.1457286250.20602.python-list@python.org>
References: <1ed89545-f102-4538-bfe2-9d0e3dac8cf5@googlegroups.com> <cbebb763-e613-48cb-b68c-b126f1551dc2@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Precedence: list
Xref: csiph.com comp.lang.python:104161

On Sun, 6 Mar 2016 06:55:04 -0800 (PST), Ömer sar?
<sari.omer.1989@gmail.com> declaimed the following:


>for example : some websites ask for a password including some specific characters , like one letter, one ( /,%,*,),(,...) so my purpose is to create a program .first ask for username , then password , then check them , if they don't match with stored (username and password ) , make them register and during that , store "username " and "password" but "password must be including 1 letter , 1 sign , and less than 10 length , more than 4 . l don't know how to do it.as l tried many things but  l got error . l hope it would be more explaintory as my English is not good enough.thanks for any advice in advance

	A proper website will NOT "first ask for username, then password", but
will present a form with fields for both items -- and maybe a button for
new registrations.

	Granted, testing algorithms using a console does mean having to prompt
for things in sequence (in which case I'd put "new register" first, since
asking for a username/password for someone not in the system before letting
them register is annoying)...

	You should also not test the username for validity and then ask for
password -- that way leads to hacking as one can test names until they get
a valid one, and then test passwords with just that name. Instead you
accept both username and password before checking anything, and return
success/failure on the full combination.

	Usernames and hashed passwords should be stored in some database, so
you can come back to it later. You do not store plain text passwords; you
store a one-way hash of the password (read the Python library reference on
"crypt"). 

	If you forbid commas and spaces from usernames and passwords, you could
use a single console input statement for everything

login = raw_input("Enter username,password or 'register' if new=> ")
if login.lower().startswith("register"):
	# do new user registration stuff
	# get user name
	# get password
	# confirm password
	# generate random salt
	# crypt (salt+password)
	#save uname, crypted hash in database
else:
	uname, pword = login.split(",")
	if not uname or not pword:
		#user did not supply both fields
		#error exit
	#fetch record for "uname" from database
	#if no record, error exit
	#pull salt from hashed password, 
	#compute crypt(salt+pword)
	#compare new hash to database record
	#if no match, error exit

	NOTE: a website will also be using cookies (another randomized value
that can be stored in a database with stuff like auto-logoff time) to
maintain session history of a valid login. All web pages after login will
request the cookie (that had been sent to the browser on successful login)
to be returned, the server than checks the cookie against the one it stored
in a database to see if the user is still valid. The database may also have
record of what page the user is one, links to (for an order site) the
current shopping cart, etc..
-- 
	Wulfraed                 Dennis Lee Bieber         AF6VN
    wlfraed@ix.netcom.com    HTTP://wlfraed.home.netcom.com/