That way, using `secrets.compare_digest()` in your application code, it will be safe against this whole range of security attacks.

### Return the error

After detecting that the credentials are incorrect, return an `HTTPException` with a status code 401 (the same returned when no credentials are provided) and add the header `WWW-Authenticate` to make the browser show the login prompt again:

```Python hl_lines="1  11-21"
{!../../../docs_src/security/tutorial007.py!}
```

👉 🔜 🎏:

```Python
if not (credentials.username == "stanleyjobson") or not (credentials.password == "swordfish"):
    # Return some error
    ...
```

✋️ ⚙️ `secrets.compare_digest()` ⚫️ 🔜 🔐 🛡 🆎 👊 🤙 "🕰 👊".

### ⏲ 👊

✋️ ⚫️❔ "⏲ 👊"❓

➡️ 🌈 👊 🔄 💭 🆔 & 🔐.

& 👫 📨 📨 ⏮️ 🆔 `johndoe` & 🔐 `love123`.