# Security - First Steps { #security-first-steps }

Let's imagine that you have your **backend** API in some domain.

And you have a **frontend** in another domain or in a different path of the same domain (or in a mobile application).

And you want to have a way for the frontend to authenticate with the backend, using a **username** and **password**.

We can use **OAuth2** to build that with **FastAPI**.

# First Steps { #first-steps }

The simplest FastAPI file could look like this:

{* ../../docs_src/first_steps/tutorial001.py *}

Copy that to a file `main.py`.

Run the live server:

<div class="termy">

```console
$ <font color="#4E9A06">fastapi</font> dev <u style="text-decoration-style:solid">main.py</u>

  <span style="background-color:#009485"><font color="#D3D7CF"> FastAPI </font></span>  Starting development server 🚀

        } else if (first != null && second != null) {
            // Both non-null - should be same instance
            assertSame(first, second, "Second getSubject should return same cached instance as first");
        } else {
            fail("Inconsistent behavior: first=" + first + ", second=" + second);
        }

        // Third call should return the same cached Subject instance

        InvertibleCryptographer first = securityResourceProvider.providePrimaryInvertibleCryptographer();
        InvertibleCryptographer second = securityResourceProvider.providePrimaryInvertibleCryptographer();

        assertNotNull(first);
        assertNotNull(second);
        assertSame(first, second);
        assertSame(invertibleCryptographer, first);
    }

        // Then: Will create new connection since real transport has no socket
        assertNotSame(first, second, "Should create new connection when first is disconnected");
    }

    @Test
    @DisplayName("Should create new connection when force signing differs")
    void testNoReuseWithDifferentSigning() throws Exception {
        // Given: An existing connection without signing enforced

// string ends with a NUL character. Thus, all n bytes are available for output.
//
// If operating in binary mode, this assumes strict GNU binary mode; which means
// that the first byte can only be either 0x80 or 0xff. Thus, the first byte is
// equivalent to the sign bit in two's complement form.
func fitsInBase256(n int, x int64) bool {
	binBits := uint(n-1) * 8
	return n >= 9 || (x >= -1<<binBits && x < 1<<binBits)
}

        // Should alternate between channels
        ChannelInfo first = loadBalancer.selectChannel(mockMessage);
        ChannelInfo second = loadBalancer.selectChannel(mockMessage);

        assertNotNull(first);
        assertNotNull(second);
        // Due to round-robin, should get different channels or same order
        assertTrue(Arrays.asList(channel1, channel2).contains(first));

        // Load data first
        protwordsFile.reload(null);

        // Test with offset out of bounds
        PagingList<ProtwordsItem> list = protwordsFile.selectList(100, 10);
        assertEquals(0, list.size());
        assertTrue(list.isEmpty());
    }

    public void test_selectList_negativeOffset() {
        // Load data first
        protwordsFile.reload(null);

	}

	if u, err := gorm.G[User](DB).Select("name").Where("name = ?", user.Name).First(ctx); err != nil {
		t.Fatalf("failed to find user, got error: %v", err)
	} else if u.Name != user.Name || u.Age != 0 {
		t.Errorf("found invalid user, got %v, expect %v", u, user)
	}

	if u, err := gorm.G[User](DB).Omit("name").Where("name = ?", user.Name).First(ctx); err != nil {
		t.Fatalf("failed to find user, got error: %v", err)

You can create dependencies that have **sub-dependencies**.

They can be as **deep** as you need them to be.

**FastAPI** will take care of solving them.

## First dependency "dependable" { #first-dependency-dependable }

You could create a first dependency ("dependable") like:

{* ../../docs_src/dependencies/tutorial005_an_py310.py hl[8:9] *}

It declares an optional query parameter `q` as a `str`, and then it just returns it.