# Einen Error zurückgeben
    ...
```

Aber durch die Verwendung von `secrets.compare_digest()` ist dieser Code sicher vor einer Art von Angriffen, die „Timing-Angriffe“ genannt werden.

### Timing-Angriffe

Aber was ist ein „Timing-Angriff“?

Stellen wir uns vor, dass einige Angreifer versuchen, den Benutzernamen und das Passwort zu erraten.

    /**
     * Gets the external profiles that were active during model building. External profiles are those that were
     * contributed by {@link ModelBuildingRequest#getProfiles()}.
     *
     * @return The active external profiles or an empty list if none, never {@code null}.
     */
    List<Profile> getActiveExternalProfiles();

    /**

Wenn wir in unseren Tests asynchrone Funktionen aufrufen möchten, müssen unsere Testfunktionen asynchron sein. AnyIO stellt hierfür ein nettes Plugin zur Verfügung, mit dem wir festlegen können, dass einige Testfunktionen asynchron aufgerufen werden sollen.

## HTTPX

Auch wenn Ihre **FastAPI**-Anwendung normale `def`-Funktionen anstelle von `async def` verwendet, handelt es sich darunter immer noch um eine `async`hrone Anwendung.

     * @param model The model to validate, must not be {@code null}.
     * @param request The model building request that holds further settings, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    default void validateFileModel(Model model, ModelBuildingRequest request, ModelProblemCollector problems) {
        // do nothing
    }

    /**

    /**
     * Gets the problems that were encountered during the settings building. Note that only problems of severity
     * {@link SettingsProblem.Severity#WARNING} and below are reported here. Problems with a higher severity level cause
     * the settings builder to fail with a {@link SettingsBuildingException}.
     *

     */
    ModelBuildingRequest getRequest();

    /**
     * Gets the container used to collect problems that were encountered while processing the event.
     *
     * @return The container used to collect problems that were encountered, never {@code null}.
     */
    ModelProblemCollector getProblems();

     * @param request The model building request that holds further settings, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    void injectProfile(Model model, Profile profile, ModelBuildingRequest request, ModelProblemCollector problems);

    /**

    /**
     * Validate the specified settings.
     *
     * @param settings The settings to validate, must not be {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     */
    void validate(Settings settings, SettingsProblemCollector problems);

    /**
     * Validate the specified settings.
     *

     * @param context The environmental context used to determine the activation status of the profile, must not be
     *            {@code null}.
     * @param problems The container used to collect problems (e.g. bad syntax) that were encountered, must not be
     *            {@code null}.
     * @return {@code true} if the profile is active, {@code false} otherwise.
     */

     * @param context The environmental context used to determine the activation status of a profile, must not be
     *            {@code null}.
     * @param problems The container used to collect problems that were encountered, must not be {@code null}.
     * @return The profiles that have been activated, never {@code null}.
     */
    List<Profile> getActiveProfiles(