现在回过头来理解这些内容。

`password` “流”（flow）是 OAuth2 定义的处理安全与身份验证的一种方式。

OAuth2 的设计目标是让后端或 API 与负责用户认证的服务器解耦。

但在这个例子中，**FastAPI** 应用同时处理 API 和认证。

从这个简化的角度来看看流程：

* 用户在前端输入 `username` 和 `password`，然后按下 `Enter`。
* 前端（运行在用户浏览器中）把 `username` 和 `password` 发送到我们 API 中的特定 URL（使用 `tokenUrl="token"` 声明）。
* API 校验 `username` 和 `password`，并返回一个“令牌”（这些我们尚未实现）。
    * “令牌”只是一个字符串，包含一些内容，之后可用来验证该用户。
    * 通常，令牌会在一段时间后过期。

It also includes what has changed, how validations are now more correct and strict, possible caveats, etc.

You can read it to understand better what has changed.

## Tests { #tests }

Make sure you have [tests](../tutorial/testing.md) for your app and you run them on continuous integration (CI).

Ardından bunu bir attribute’un tipi olarak kullanabiliriz:

{* ../../docs_src/body_nested_models/tutorial004_py310.py hl[18] *}

Bu da **FastAPI**’nin aşağıdakine benzer bir body bekleyeceği anlamına gelir:

```JSON
{
    "name": "Foo",
    "description": "The pretender",
    "price": 42.0,
    "tax": 3.2,
    "tags": ["rock", "metal", "bar"],
    "image": {

    // GWT's ConcurrentHashMap is a wrapper around HashMap, but it rejects null keys, which matches
    // the behaviour of the non-GWT implementation of newConcurrentHashSet().
    // On the other hand HashSet might be better for code size if apps aren't
    // already using Collections.newSetFromMap and ConcurrentHashMap.
    return Collections.newSetFromMap(new ConcurrentHashMap<E, Boolean>());
  }

 *
 * <p>The {@link #count} and {@link #size} implementations all iterate across the set returned by
 * {@link Multiset#entrySet()}, as do many methods acting on the set returned by {@link
 * #elementSet()}. Override those methods for better performance.
 *
 * @author Kevin Bourrillion
 * @author Louis Wasserman
 */
@GwtCompatible
abstract class AbstractMultiset<E extends @Nullable Object> extends AbstractCollection<E>
    implements Multiset<E> {

        // but we can check that it's not zero.
        long writtenTime = SMBUtil.readInt4(dst, 2) & 0xFFFFFFFFL;
        // This is a weak check, but better than nothing.
        // A more robust test would require a real SMB1SigningDigest.
        assertTrue(writtenTime != 0 || lastWriteTime == 0);
    }

    /**

## Future { #future }

By this point, it's already clear that **FastAPI** with its ideas is being useful for many people.

It is being chosen over previous alternatives for suiting many use cases better.

Many developers and teams already depend on **FastAPI** for their projects (including me and my team).

But still, there are many improvements and features to come.

**FastAPI** has a great future ahead.

/// note

FastAPI will know that the value of `q` is not required because of the default value `= None`.

Having `str | None` will allow your editor to give you better support and detect errors.

///

## Additional validation { #additional-validation }

We are going to enforce that even though `q` is optional, whenever it is provided, **its length doesn't exceed 50 characters**.

Але в нашому випадку той самий застосунок **FastAPI** оброблятиме і API, і автентифікацію.

Тож розгляньмо це у спрощеному вигляді:

- Користувач вводить `username` і `password` у frontend і натискає `Enter`.
- Frontend (у браузері користувача) надсилає ці `username` і `password` на специфічну URL-адресу нашого API (оголошену як `tokenUrl="token"`).

 *  Fix: Handle null fragments.
 *  Fix: Don’t crash on interceptors that throw `IOException` before a
    connection is attempted.
 *  New: Support [WebDAV][webdav] HTTP methods.
 *  New: Buffer WebSocket frames for better performance.
 *  New: Drop support for `TLS_DHE_DSS_WITH_AES_128_CBC_SHA`, our only remaining
    DSS cipher suite. This is consistent with Firefox and Chrome which have also
    dropped these cipher suite.