Question: I have a list of users store in an array

```json
accountsade: [
    {
        id: 0.4387810413935975
        name: "Adrian"
        password: "345"
        userName: "nathanael"
    },
    {
        id: 0.2722524232951682
        name: "Nathan"
        password: "123"
        userName: "nathanaelmbale45"
    }
],

```

And I want to loop through the list of users and capture the values `password`, and `username`
of every single object in the array and compare them to already existing variables.

```
usernameL = "nathanaelmbale45"
passwordL = "123"

```

Answer: 
```
    <script>
    let accountsade = [
        {
            id: 0.4387810413935975,
            name: "Adrian",
            password: "345",
            userName: "nathanael",
        },
        {
            id: 0.2722524232951682,
            name: "Nathan",
            password: "123",
            userName: "nathanaelmbale45"
        }
    ]
    let userName = 'nathanael', password = '345';
    let account = accountsade.filter((item) => {
        return item.userName === userName && item.password == password;
    });
    console.log(account);
</script>

```

-----------# output #-----------------

```
[{"id":0.4387810413935975,"name":"Adrian","password":"345","userName":"nathanael"}]

```
First of all: authenticating users like this is not safe. I'll tell you why in a minute, but let's solve your actual question first.

You can use JavaScript's [Array.prototype.filter()](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/filter) function to fetch the right object in the list. Then, you can check if that object's password matches the input:

```js
const json = {
    accountsade: [
        {
            id: 0.4387810413935975,
            name: "Adrian",
            password: "345",
            userName: "nathanael"
        },
        {
            id: 0.2722524232951682,
            name: "Nathan",
            password: "123",
            userName: "nathanaelmbale45"
        }
    ]
};

const usernameL = "nathanaelmbale45";
const passwordL = "123";

alert(checkLogin(usernameL, passwordL));

function checkLogin(username, password) {
    const account = json.accountsade.find(account => {
      return account.userName = username;
    });
    return account.password == password;
}
```

Proper authentication
---------------------

he goal of authenticating a user is to make sure that a user is who he/she says he/she is. That way, you can decide in your code what actions a user can take.

This process should be doe in the back end (server side) of your application, to make sure that the user can't see and manipulate it. If you send all of the account data over to the front end (your user's computer), that person can see all of that data and use other user's passwords to log in.

You also didn't [hash the passwords](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) (scramble their contents in a non-reversable way). This should even be done when handling authentication server side, as your database could be compromised and leaked by another security failure.

Another downside of sending all account data to the front end, is bandwith. Suppose you have a million user's, that will take a lot of redundant time and resources just to log the user in.

So the right way is: send the username and password that the user entered [via a secure connection](https://www.howtogeek.com/181767/htg-explains-what-is-https-and-why-should-i-care/) (so nobody can eavesdrop), fetch the hashed password from the database, hash the password that the user entered and compare it too the fetched hash. If they match exactly, the user is legitimate and can be logged in (set the appropriate cookies server side or send an [authentication token](https://auth0.com/learn/token-based-authentication-made-easy/#!)).

Now those are the basics, but it's safer to use proven solutions like frameworks and libraries that do this work for you instead of building this yourself (lots of users have looked at the code already and improved it, you on the other hand might make a mistake/create a security risk).