# Поверніть якусь помилку
    ...
```

Але використовуючи `secrets.compare_digest()`, це буде захищено від типу атак, що називаються «атаки за часом» (timing attacks).

### Атаки за часом { #timing-attacks }

Що таке «атака за часом»?

Уявімо, що зловмисники намагаються вгадати ім'я користувача та пароль.

Вони надсилають запит з ім'ям користувача `johndoe` та паролем `love123`.

least 1024 bits. This behavior can be controlled with the `rsa1024min` setting.
Using `rsa1024min=0` restores the Go 1.23 behavior.

Go 1.24 introduced a mechanism for enabling platform specific Data Independent
Timing (DIT) modes in the [`crypto/subtle`](/pkg/crypto/subtle) package. This
mode can be enabled for an entire program with the `dataindependenttiming` setting.

   * <p>This executor is appropriate for tasks that are lightweight and not deeply chained.
   * Inappropriate {@code directExecutor} usage can cause problems, and these problems can be
   * difficult to reproduce because they depend on timing. For example:
   *
   * <ul>
   *   <li>When a {@code ListenableFuture} listener is registered to run under {@code
   *       directExecutor}, the listener can execute in any of three possible threads:
   *       <ol>

   *
   * <p>The default implementation of this method in {@code AbstractFuture} does nothing. This is
   * intended for very lightweight cleanup work, for example, timing statistics or clearing fields.
   * If your task does anything heavier consider, just using a listener with an executor.
   *
   * @since 20.0
   */
  @ForOverride
  protected void afterDone() {}

    val requestBodyDelay = 250L
    val responseHeadersStartDelay = 250L
    val responseBodyStartDelay = 250L
    val responseBodyEndDelay = 250L

    // Warm up the client so the timing part of the test gets a pooled connection.
    server.enqueue(MockResponse())
    val warmUpCall =
      client.newCallWithListener(
        Request
          .Builder()
          .url(server.url("/"))

    # Вернуть ошибку
    ...
```

Но используя `secrets.compare_digest()`, вы защитите код от атак типа «тайминговая атака» (атака по времени).

### Тайминговые атаки { #timing-attacks }

Что такое «тайминговая атака»?

Представим, что злоумышленники пытаются угадать имя пользователя и пароль.

И они отправляют запрос с именем пользователя `johndoe` и паролем `love123`.

        .thatReturn(Future.class)
        .testNulls();
  }

  // This test covers a bug where an Error thrown from a callback could cause the TimeoutFuture to
  // never complete when timing out.  Notably, nothing would get logged since the Error would get
  // stuck in the ScheduledFuture inside of TimeoutFuture and nothing ever calls get on it.

        .thatReturn(Future.class)
        .testNulls();
  }

  // This test covers a bug where an Error thrown from a callback could cause the TimeoutFuture to
  // never complete when timing out.  Notably, nothing would get logged since the Error would get
  // stuck in the ScheduledFuture inside of TimeoutFuture and nothing ever calls get on it.

- Client-go: Informer resync processing improved handling of Resync handling. This reduces contention on store locks between incoming events and handler updates, which may result in observable timing differences of handler invocations. This behavior is guarded by an AtomicFIFO feature gate. This gate is enabled by default in 1.36, but can be disabled if needed to temporarily regain the previous behavior. ([#136008](https://github.com/kubernet...

    # Renvoyer une erreur
    ...
```

Mais en utilisant `secrets.compare_digest()`, cela sera sécurisé contre un type d'attaques appelé « attaques par chronométrage ».

### Attaques par chronométrage { #timing-attacks }

Mais qu'est-ce qu'une « attaque par chronométrage » ?

Imaginons que des attaquants essaient de deviner le nom d'utilisateur et le mot de passe.