<img src="/img/tutorial/security/image10.png">

!!! note
    Notice the header `Authorization`, with a value that starts with `Bearer `.

## Advanced usage with `scopes`

OAuth2 has the notion of "scopes".

You can use them to add a specific set of permissions to a JWT token.

    val socketFactory = buildServerSslSocketFactory()
    server.useHttps(socketFactory)
    server.requestClientAuth()
    server.enqueue(
      MockResponse.Builder()
        .body("abc")
        .build(),
    )
    val call = client.newCall(Request.Builder().url(server.url("/")).build())
    val response = call.execute()
    assertThat(response.handshake!!.peerPrincipal)

  val platform = PlatformRule()
  private lateinit var server: MockWebServer
  private lateinit var dns: Dns
  private val cacheFs = FakeFileSystem()
  private val bootstrapClient =
    OkHttpClient.Builder()
      .protocols(listOf(Protocol.HTTP_2, Protocol.HTTP_1_1))
      .build()

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
    server.protocols = bootstrapClient.protocols

Similarly, if your TLS certificates do not have the IP SAN for the MinIO server host, the MinIO Console may fail to validate the connection to the server. Use the `MINIO_SERVER_URL` environment variable  and specify the proxy-accessible hostname of the MinIO server to allow the Console to use the MinIO server API using the TLS certificate.

For example: `export MINIO_SERVER_URL="https://minio.example.net"`

          }
          line[0] == ':' -> {
            // Work around empty header names and header names that start with a colon (created by old
            // broken SPDY versions of the response cache).
            addLenient("", line.substring(1)) // Empty header name.
          }
          else -> {
            // No header name.
            addLenient("", line)
          }
        }
      }

MINIO_IDENTITY_LDAP_SERVER_INSECURE         (on|off)    allow plain text connection to AD/LDAP server, defaults to "off"
MINIO_IDENTITY_LDAP_SERVER_STARTTLS         (on|off)    use StartTLS connection to AD/LDAP server, defaults to "off"
```

The server address variable is _required_. TLS is assumed to be on by default. The port in the server address is optional and defaults to 636 if not provided.

    Moshi.Builder()
      .add(KotlinJsonAdapterFactory())
      .build()

  private val handshakeCertificates = localhost()

  private lateinit var server: MockWebServer

  @BeforeEach
  fun setup(server: MockWebServer) {
    this.server = server
  }

  @Test
  fun testPlatform() {
    assertTrue(Platform.isAndroid)

    if (Build.VERSION.SDK_INT >= 29) {

//tensorflow/core:image_testdata
//tensorflow/core/kernels/cloud:bigquery_reader_ops
//tensorflow/python:extra_py_tests_deps
//tensorflow/python:mixed_precision
//tensorflow/python:tf_optimizer
//tensorflow/python:compare_test_proto_py
//tensorflow/python/framework:test_file_system.so
//tensorflow/python/debug:grpc_tensorflow_server.par
//tensorflow/python/feature_column:vocabulary_testdata

    /**
     * Returns true if the request contains conditions that save the server from sending a response
     * that the client has locally. When a request is enqueued with its own conditions, the built-in
     * response cache won't be used.
     */
    private fun hasConditions(request: Request): Boolean =
      request.header("If-Modified-Since") != null || request.header("If-None-Match") != null
  }

  companion object {

```Python
from .dependencies import get_token_header
```

would mean:

* Starting in the same package that this module (the file `app/routers/items.py`) lives in (the directory `app/routers/`)...
* find the module `dependencies` (an imaginary file at `app/routers/dependencies.py`)...
* and from it, import the function `get_token_header`.