* String (`str`) fields, defining min and max lengths.
    * Numbers (`int`, `float`) with min and max values, etc.

* Validation for more exotic types, like:
    * URL.
    * Email.
    * UUID.
    * ...and others.

All the validation is handled by the well-established and robust **Pydantic**.

### Security and authentication { #security-and-authentication }

    * Numaralar (`int`, `float`) maksimum ve minimum gibi sınırlandırmalar yaparken.

* Bunlar gibi en egzotik typelarla bile doğrulama yapabiliyorsunuz.:
    * URL.
    * Email.
    * UUID.
    * ...ve diğerleri.

Bütün doğrulama olayları çok güçlü bir kütüphane sayesinde yapılıyor, **Pydantic**.

### Güvenlik ve kimlik doğrulama

# ----------------------------------------------------------
# Hibernate Validator
# -------------------
constraints.CreditCardNumber.message = {item} 不是有效的信用卡號。
constraints.EAN.message = {item} 不是有效的 {type} 條碼。
constraints.Email.message = {item} 不是有效的電子郵件地址。
constraints.Length.message = {item} 的長度必須在 {min} 到 {max} 之間。
constraints.LuhnCheck.message = {value} 的 Luhn Modulo 11 檢查碼不正確。
constraints.Mod10Check.message = {value} 的 Modulo 10 檢查碼不正確。

    * Campos de cadena de caracteres (`str`), definiendo longitudes mínimas y máximas.
    * Números (`int`, `float`) con valores mínimos y máximos, etc.

* Validación para tipos más exóticos, como:
    * URL.
    * Email.
    * UUID.
    * ...y otros.

Toda la validación es manejada por **Pydantic**, una herramienta bien establecida y robusta.

### Seguridad y autenticación { #security-and-authentication }

# Hibernate Validator
# -------------------
constraints.CreditCardNumber.message = {item} no es un número de tarjeta de crédito válido.
constraints.EAN.message = {item} no es un código de barras {type} válido.
constraints.Email.message = {item} no es una dirección de correo electrónico válida.
constraints.Length.message = La longitud de {item} debe estar entre {min} y {max}.

    * campos String (`str`), definindo tamanho mínimo e máximo.
    * Numbers (`int`, `float`) com valores mínimos e máximos, etc.

* Validação de tipos mais exóticos, como:
    * URL.
    * Email.
    * UUID.
    * ...e outros.

Toda a validação é controlada pelo robusto e bem estabelecido **Pydantic**.

### Segurança e autenticação { #security-and-authentication }

///

<img src="/img/tutorial/security/image08.png">

Chame o endpoint `/users/me/`, você receberá o retorno como:

```JSON
{
  "username": "johndoe",
  "email": "******@****.***",
  "full_name": "John Doe",
  "disabled": false
}
```

<img src="/img/tutorial/security/image09.png">

* 校验大部分（甚至所有？）的 Python **数据类型**，包括：
    * JSON 对象 (`dict`).
    * JSON 数组 (`list`) 定义成员类型。
    * 字符串 (`str`) 字段, 定义最小或最大长度。
    * 数字 (`int`, `float`) 有最大值和最小值， 等等。

* 校验外来类型， 比如:
    * URL.
    * Email.
    * UUID.
    * ...及其他.

所有的校验都由完善且强大的 **Pydantic** 处理。

### 安全性及身份验证

集成了安全性和身份认证。杜绝数据库或者数据模型的渗透风险。

OpenAPI 中定义的安全模式，包括：

* HTTP 基本认证。

///

<img src="/img/tutorial/security/image08.png">

Call the endpoint `/users/me/`, you will get the response as:

```JSON
{
  "username": "johndoe",
  "email": "******@****.***",
  "full_name": "John Doe",
  "disabled": false
}
```

<img src="/img/tutorial/security/image09.png">

# Settings and Environment Variables { #settings-and-environment-variables }

In many cases your application could need some external settings or configurations, for example secret keys, database credentials, credentials for email services, etc.

Most of these settings are variable (can change), like database URLs. And many could be sensitive, like secrets.

For this reason it's common to provide them in environment variables that are read by the application.

/// tip