* HTTP Basic.
* **OAuth2** (ook met **JWT tokens**). Bekijk de tutorial over [OAuth2 with JWT](tutorial/security/oauth2-jwt.md){.internal-link target=_blank}.
* API keys in:
    * Headers.
    * Query parameters.
    * Cookies, enz.

Plus alle beveiligingsfuncties van Starlette (inclusief **sessiecookies**).

package event

import (
	"context"
	"crypto/rand"
	"errors"
	"reflect"
	"testing"
	"time"

	"github.com/minio/minio/internal/store"
)

type ExampleTarget struct {
	id       TargetID
	sendErr  bool
	closeErr bool
}

func (target ExampleTarget) ID() TargetID {
	return target.id
}

// Save - Sends event directly without persisting.
func (target ExampleTarget) Save(eventData Event) error {

    return {"scheme": credentials.scheme, "credentials": credentials.credentials}


client = TestClient(app)


def test_security_http_bearer():
    response = client.get("/users/me", headers={"Authorization": "Bearer foobar"})
    assert response.status_code == 200, response.text
    assert response.json() == {"scheme": "Bearer", "credentials": "foobar"}


def test_security_http_bearer_no_credentials():

    return {"scheme": credentials.scheme, "credentials": credentials.credentials}


client = TestClient(app)


def test_security_http_digest():
    response = client.get("/users/me", headers={"Authorization": "Digest foobar"})
    assert response.status_code == 200, response.text
    assert response.json() == {"scheme": "Digest", "credentials": "foobar"}


def test_security_http_digest_no_credentials():

* `path` - The file path to the file to stream.
* `headers` - Any custom headers to include, as a dictionary.
* `media_type` - A string giving the media type. If unset, the filename or path will be used to infer a media type.
* `filename` - If set, this will be included in the response `Content-Disposition`.

File responses will include appropriate `Content-Length`, `Last-Modified` and `ETag` headers.

```Python hl_lines="2  10"

    return {"scheme": credentials.scheme, "credentials": credentials.credentials}


client = TestClient(app)


def test_security_http_bearer():
    response = client.get("/users/me", headers={"Authorization": "Bearer foobar"})
    assert response.status_code == 200, response.text
    assert response.json() == {"scheme": "Bearer", "credentials": "foobar"}


def test_security_http_bearer_no_credentials():

    assert response.json() == {"item": "The Foo Wrestlers"}


def test_get_item_not_found_header():
    response = client.get("/items-header/bar")
    assert response.status_code == 404, response.text
    assert response.headers.get("x-error") == "There goes my error"
    assert response.json() == {"detail": "Item not found"}


def test_openapi_schema():
    response = client.get("/openapi.json")

  @Throws(IOException::class)
  fun connectionPreface() {
    this.withLock {
      if (closed) throw IOException("closed")
      if (!client) return // Nothing to write; servers don't send connection headers!
      if (logger.isLoggable(FINE)) {
        logger.fine(format(">> CONNECTION ${CONNECTION_PREFACE.hex()}"))
      }
      sink.write(CONNECTION_PREFACE)
      sink.flush()
    }
  }

    assert actual_schema == schema
    assert (
        len(actual_schema["paths"]["/"]["get"]["parameters"]) == 1
    )  # primary goal of this test


def test_response():
    response = client.get("/", headers={"someheader": "hello"})
    assert response.status_code == status.HTTP_200_OK

```Python hl_lines="8-9  11  14"
{!../../docs_src/middleware/tutorial001.py!}
```

/// tip

Keep in mind that custom proprietary headers can be added <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers" class="external-link" target="_blank">using the 'X-' prefix</a>.