"net/http/httptest"
	"net/url"
	"strconv"
	"testing"

	"github.com/minio/minio/internal/crypto"
	"github.com/minio/minio/internal/grid"
	xhttp "github.com/minio/minio/internal/http"
)

// Tests request guess function for net/rpc requests.
func TestGuessIsRPC(t *testing.T) {
	if guessIsRPCReq(nil) {
		t.Fatal("Unexpected return for nil request")
	}

	u, err := url.Parse("http://localhost:9000/minio/lock")
	if err != nil {

            // TODO: SMB2 - do we need to check the MIDs?
            // We only read what we were waiting for, so first guess would be no.
            boolean verify = dgst.verify(buffer, i, size, 0, this);
            this.verifyFailed = verify;
            return !verify;
        }
        return true;
    }

    assertExpectedBytes(out.toByteArray());
  }

  public void testCopyTo_byteSink() throws IOException {
    final ByteArrayOutputStream out = new ByteArrayOutputStream();
    // HERESY! but it's ok just for this I guess
    source.copyTo(
        new ByteSink() {
          @Override
          public OutputStream openStream() throws IOException {
            return out;
          }
        });

```

But by using the `secrets.compare_digest()` it will be secure against a type of attacks called "timing attacks".

### Timing Attacks

But what's a "timing attack"?

Let's imagine some attackers are trying to guess the username and password.

And they send a request with a username `johndoe` and a password `love123`.

Then the Python code in your application would be equivalent to something like:

```Python

    // TODO(cpovirk): Consider using Object[] anyway.
    E[] array = (E[]) elements.toArray();
    /*
     * For a Set, we guess that it contains no duplicates. That's just a guess for purpose of
     * sizing; if the Set uses different equality semantics, it might contain duplicates according
     * to equals(), and we will deduplicate those properly, albeit at some cost in allocations.

 plugin parameters and anything else.

 We once had a document that Vincent and I agreed upon and I was about to
 implement it and then I disappeared for 8 months so it never came to pass.

 So I guess it's important to figure out what people are using properties
 files for and see if we can't incorporate it all into the POM. Or if we do
 have properties file (something I would like to avoid) say they don't

        "//tensorflow/core/tfrt/common:async_value_tensor",
        "//tensorflow/core/tfrt/common:pjrt_util",
        "@com_google_absl//absl/log:check",
        "@com_google_googletest//:gtest_main",
        "@local_tsl//tsl/lib/core:status_test_util",
        "@local_tsl//tsl/platform:casts",
        "@local_tsl//tsl/platform:status_matchers",
        "@local_tsl//tsl/protobuf:error_codes_proto_impl_cc",

            } else {
    
                /* On NT without Unicode the fileNameLength
                 * includes the '\0' whereas on win98 it doesn't. I
                 * guess most clients only support non-unicode so
                 * they don't run into this.
                 */
    
    /* UPDATE: Maybe not! Could this be a Unicode alignment issue. I hope

			return "", "", err
		}

		host = addr

		switch scheme {
		case "https":
			port = "443"
		case "http":
			port = "80"
		default:
			return "", "", errors.New("unable to guess port from scheme")
		}
	}

	return host, port, nil
}

// isLocalHost - checks if the given parameter
// correspond to one of the local IP of the
// current machine

### 2. Configure WSO2

Once WSO2 is up and running, configure WSO2 to generate Self contained id_tokens. In OAuth 2.0 specification there are primarily two ways to provide id_tokens

1. The id_token is an identifier that is hard to guess. For example, a randomly generated string of sufficient length, that the server handling the protected resource can use to lookup the associated authorization information.