Anticipating misuse, Authentication

Defensive design considerations: Anticipating misuse, Authentication

2.3.1 Defensive Design

Defensive Design — Note 1 of 3

Understanding of the issues a programmer should consider to ensure that a program caters for all likely input values; Understanding of how to deal with invalid data in a program; Authentication to confirm the identity of a user

What you need to know

Defensive design means writing programs that can handle unexpected or incorrect inputs by anticipating how users might misuse the program. Authentication is the process of verifying a user's identity, typically through a username and password. Good defensive design reduces bugs and ensures the program behaves correctly regardless of what the user enters.

What to know

Defensive design anticipates misuse: programs should handle unexpected or erroneous inputs gracefully.
It reduces bugs and ensures the program behaves as expected regardless of user input.
Authentication ensures only certain/authorised users can access the system.
Input sanitisation: removing invalid/special characters (e.g. quotation marks, semicolons) from input to prevent attacks.
Programs should never crash due to user input; errors should be handled with appropriate messages.
Defensive design methods: authentication, anticipating misuse, validation, input sanitisation, maintainability.

Key terms

Exam tipCommon mistake

Authentication: Verifying a user's identity, typically through a username and password.
Exam tip: When asked about authentication, say it 'ensures only certain users can access the system' AND give an example like 'using a username and password'.

Exam technique

Tip:When describing a defensive design method, name the METHOD and then DESCRIBE/GIVE AN EXAMPLE. E.g. 'Validation — restrict ratings to 1-5 to ensure only sensible data is entered'.
Tip:Validation only applies to USER inputs. You do not need to validate randomly generated numbers (they are not user input).

Code examples

Simple authentication

python

# Simple username and password authentication
stored_user = "admin"
stored_pass = "secret123"

username = input("Username: ")
password = input("Password: ")

if username == stored_user and password == stored_pass:
    print("Access granted")
else:
    print("Access denied")

Ready to test yourself?

Practise 2.3.1 questions

← Previous topicRandom number generation2.2.3 Additional Programming Techniques Next note →Input validation2.3.1 Defensive Design

Back to Defensive Design

Revise another OCR GCSE topic: Testing

# Simple username and password authentication stored_user = "admin" stored_pass = "secret123" username = input("Username: ") password = input("Password: ") if username == stored_user and password == stored_pass: print("Access granted") else: print("Access denied")