<img src="/img/tutorial/security/image12.png">

## Den Benutzernamen überprüfen

Hier ist ein vollständigeres Beispiel.

Verwenden Sie eine Abhängigkeit, um zu überprüfen, ob Benutzername und Passwort korrekt sind.

Verwenden Sie dazu das Python-Standardmodul <a href="https://docs.python.org/3/library/secrets.html" class="external-link" target="_blank">`secrets`</a>, um den Benutzernamen und das Passwort zu überprüfen.

The correct place is:

* In the key `content`, that has as value another JSON object (`dict`) that contains:
    * A key with the media type, e.g. `application/json`, that contains as value another JSON object, that contains:
        * A key `schema`, that has as the value the JSON Schema from the model, here's the correct place.

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

#### Fix it with `secrets.compare_digest()`

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-sha1</artifactId>
  <version>${sha1}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <artifactId>valid-version-changelist</artifactId>
  <version>${changelist}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  </parent>
  <groupId>com.example.group</groupId>
  <artifactId>valid-version-wrong</artifactId>
  <version>1.0</version>

  <description>
    This will test if the validation for the parent version
    is working correct in case of usage of LATEST
  </description>

  <artifactId>valid-version-sha1plus</artifactId>
  <version>${sha1}${wrong}${revision}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <artifactId>valid-version-sha1plus</artifactId>
  <version>${sha1}${wrong}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-wrong</artifactId>
  <version>${wrong}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>

  <groupId>com.example.group</groupId>
  <artifactId>valid-version-revision</artifactId>
  <version>${revision}</version>

  <description>
    This will test if the validation for the ci friendly versions
    is working correct.
  </description>