The correct place is:

* In the key `content`, that has as value another JSON object (`dict`) that contains:
    * A key with the media type, e.g. `application/json`, that contains as value another JSON object, that contains:
        * A key `schema`, that has as the value the JSON Schema from the model, here's the correct place.

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

#### Fix it with `secrets.compare_digest()`

```

but this time at the URL with the prefix path provided by the proxy: `/api/v1`.

Of course, the idea here is that everyone would access the app through the proxy, so the version with the path prefix `/api/v1` is the "correct" one.

And the version without the path prefix (`http://127.0.0.1:8000/app`), provided by Uvicorn directly, would be exclusively for the _proxy_ (Traefik) to access it.

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-sha1</artifactId>
  <version>${sha1}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <artifactId>valid-version-changelist</artifactId>
  <version>${changelist}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  </parent>
  <groupId>com.example.group</groupId>
  <artifactId>valid-version-wrong</artifactId>
  <version>1.0</version>

  <description>
    This will test if the validation for the parent version
    is working correct in case of usage of LATEST
  </description>

  <artifactId>valid-version-sha1plus</artifactId>
  <version>${sha1}${wrong}${revision}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <artifactId>valid-version-sha1plus</artifactId>
  <version>${sha1}${wrong}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-wrong</artifactId>
  <version>${wrong}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-revision</artifactId>
  <version>${revision}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>