If you don't select any scope, you will be "authenticated", but when you try to access `/users/me/` or `/users/me/items/` you will get an error saying that you don't have enough permissions. You will still be able to access `/status/`.

And if you select the scope `me` but not the scope `items`, you will be able to access `/users/me/` but not `/users/me/items/`.

                                    "Expected text value 'http://www.apache.org/path/to/parent/child-artifact-id/' but was "
                                            + "'http://www.apache.org/path/to/parent/../child-artifact-id/'"),
                    afe.getMessage());
        }
        // but ok from repo: local disk is ignored
        testInheritance("tricky-flat-artifactId-urls", true);

```Python
if not (credentials.username == "stanleyjobson") or not (credentials.password == "swordfish"):
    # Return some error
    ...
```

But by using the `secrets.compare_digest()` it will be secure against a type of attacks called "timing attacks".

### Timing Attacks

But what's a "timing attack"?

Let's imagine some attackers are trying to guess the username and password.

## Parameterized dependencies

All the dependencies we have seen are a fixed function or class.

But there could be cases where you want to be able to set parameters on the dependency, without having to declare many different functions or classes.

Let's imagine that we want to have a dependency that checks if the query parameter `q` contains some fixed content.

But we want to be able to parameterize that fixed content.

## A "callable" instance

      // But theoretically we could see sneaky checked exception
      sneakyThrow(exception);
    }
  }

  /** Throws an undeclared checked exception. */
  private static void sneakyThrow(Throwable t) {
    class SneakyThrower<T extends Throwable> {
      @SuppressWarnings("unchecked") // not really safe, but that's the point
      void throwIt(Throwable t) throws T {

    /**
     * Gets the decrypted proxies.
     *
     * @return The decrypted proxy, can be empty but never {@code null}.
     */
    List<Proxy> getProxies();

    /**
     * Gets the problems that were encountered during the settings decryption.
     *
     * @return The problems that were encountered during the decryption, can be empty but never {@code null}.
     */
    List<SettingsProblem> getProblems();

///

## OpenAPI and API docs

If you return additional status codes and responses directly, they won't be included in the OpenAPI schema (the API docs), because FastAPI doesn't have a way to know beforehand what you are going to return.

{* ../../docs_src/python_types/tutorial001.py hl[2] *}

### Edit it

It's a very simple program.

But now imagine that you were writing it from scratch.

At some point you would have started the definition of the function, you had the parameters ready...

But then you have to call "that method that converts the first letter to upper case".

Was it `upper`? Was it `uppercase`? `first_uppercase`? `capitalize`?

`201` is the status code for "Created".

But you don't have to memorize what each of these codes mean.

You can use the convenience variables from `fastapi.status`.

{* ../../docs_src/response_status_code/tutorial002.py hl[1,6] *}

They are just a convenience, they hold the same number, but that way you can use the editor's autocomplete to find them:

* `compresslevel` - Used during GZip compression. It is an integer ranging from 1 to 9. Defaults to `9`. Lower value results in faster compression but larger file sizes, while higher value results in slower compression but smaller file sizes.

## Other middlewares

There are many other ASGI middlewares.

For example: