### Timing-Angriffe

Aber was ist ein „Timing-Angriff“?

Stellen wir uns vor, dass einige Angreifer versuchen, den Benutzernamen und das Passwort zu erraten.

Und sie senden eine Anfrage mit dem Benutzernamen `johndoe` und dem Passwort `love123`.

Dann würde der Python-Code in Ihrer Anwendung etwa so aussehen:

```Python

    /**
     * Gets the external profiles that were active during model building. External profiles are those that were
     * contributed by {@link ModelBuildingRequest#getProfiles()}.
     *
     * @return The active external profiles or an empty list if none, never {@code null}.
     */
    List<Profile> getActiveExternalProfiles();

    /**

Wenn wir in unseren Tests asynchrone Funktionen aufrufen möchten, müssen unsere Testfunktionen asynchron sein. AnyIO stellt hierfür ein nettes Plugin zur Verfügung, mit dem wir festlegen können, dass einige Testfunktionen asynchron aufgerufen werden sollen.

## HTTPX

Auch wenn Ihre **FastAPI**-Anwendung normale `def`-Funktionen anstelle von `async def` verwendet, handelt es sich darunter immer noch um eine `async`hrone Anwendung.

     * @param model The model to validate, must not be {@code null}.
     * @param request The model building request that holds further settings, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    default void validateFileModel(Model model, ModelBuildingRequest request, ModelProblemCollector problems) {
        // do nothing
    }

    /**

    /**
     * Gets the problems that were encountered during the settings building. Note that only problems of severity
     * {@link SettingsProblem.Severity#WARNING} and below are reported here. Problems with a higher severity level cause
     * the settings builder to fail with a {@link SettingsBuildingException}.
     *

     */
    ModelBuildingRequest getRequest();

    /**
     * Gets the container used to collect problems that were encountered while processing the event.
     *
     * @return The container used to collect problems that were encountered, never {@code null}.
     */
    ModelProblemCollector getProblems();

     * @param request The model building request that holds further settings, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    void injectProfile(Model model, Profile profile, ModelBuildingRequest request, ModelProblemCollector problems);

    /**

    /**
     * Validate the specified settings.
     *
     * @param settings The settings to validate, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    void validate(Settings settings, SettingsProblemCollector problems);

    /**
     * Validate the specified settings.
     *

     *
     * @return The decrypted proxy, can be empty but never {@code null}.
     */
    List<Proxy> getProxies();

    /**
     * Gets the problems that were encountered during the settings decryption.
     *
     * @return The problems that were encountered during the decryption, can be empty but never {@code null}.
     */
    List<SettingsProblem> getProblems();

     * @param context The environmental context used to determine the activation status of the profile, must not be
     *            {@code null}.
     * @param problems The container used to collect problems (e.g. bad syntax) that were encountered, must not be
     *            {@code null}.
     * @return {@code true} if the profile is active, {@code false} otherwise.
     */