material is shared under a Creative Commons public license or as
otherwise permitted by the Creative Commons policies published at
creativecommons.org/policies, Creative Commons does not authorize the
use of the trademark "Creative Commons" or any other trademark or logo
of Creative Commons without its prior written consent including,
without limitation, in connection with any unauthorized modifications

  optional bool allowed = 1;

  // Denied is optional. True if the action would be denied, otherwise
  // false. If both allowed is false and denied is false, then the
  // authorizer has no opinion on whether to authorize the action. Denied
  // may not be true if Allowed is true.
  // +optional
  optional bool denied = 4;

  // Reason is optional.  It indicates why a request was allowed or denied.
  // +optional

yLi); public abstract void removeComponentDisco(component.discovery.ComponentDiscoveryLi); public abstract void addJarRepository(java.io.File); public abstract void addJarResource(java.io.File) throws PlexusContainerExcep; public abstract Object autowire(Object) throws component.composition.CompositionException; public abstract Object createAndAutowire(String) throws component.composition.CompositionException, ClassNotFoundExcepti, InstantiationExcepti, IllegalAccessExcepti; public abstract void...

yLi); public abstract void removeComponentDisco(component.discovery.ComponentDiscoveryLi); public abstract void addJarRepository(java.io.File); public abstract void addJarResource(java.io.File) throws PlexusContainerExcep; public abstract Object autowire(Object) throws component.composition.CompositionException; public abstract Object createAndAutowire(String) throws component.composition.CompositionException, ClassNotFoundExcepti, InstantiationExcepti, IllegalAccessExcepti; public abstract void...

    这就是遵循标准的好处……

## 实际效果

打开 API 文档：<a href="http://127.0.0.1:8000/docs" class="external-link" target="_blank">http://127.0.0.1:8000/docs</a>。

### 身份验证

点击**Authorize**按钮。

使用以下凭证：

用户名：`johndoe`

密码：`secret`

<img src="https://fastapi.tiangolo.com/img/tutorial/security/image04.png">

通过身份验证后，显示下图所示的内容：

    list.add("a");
    list.add("b");
    Iterator<String> iterator = list.iterator();
    assertEquals("b", get(iterator, 1));
    assertFalse(iterator.hasNext());
  }

  public void testGet_atSize() {
    List<String> list = newArrayList();
    list.add("a");
    list.add("b");
    Iterator<String> iterator = list.iterator();
    try {
      get(iterator, 2);
      fail();

Вы увидите примерно следующее:

<img src="/img/tutorial/security/image01.png">

!!! check "Кнопка авторизации!"
    У вас уже появилась новая кнопка "Authorize".

    А у *операции пути* теперь появился маленький замочек в правом верхнем углу, на который можно нажать.

r zn="toast",Xn="bs.toast",$n="."+Xn,Gn=g.fn[zn],Jn={CLICK_DISMISS:"click.dismiss"+$n,HIDE:"hide"+$n,HIDDEN:"hidden"+$n,SHOW:"show"+$n,SHOWN:"shown"+$n},Zn="fade",ti="hide",ei="show",ni="showing",ii={animation:"boolean",autohide:"boolean",delay:"number"},oi={animation:!0,autohide:!0,delay:500},ri='[data-dismiss="toast"]',si=function(){function i(t,e){this._element=t,this._config=this._getConfig(e),this._timeout=null,this._setListeners()}var t=i.prototype;return t.show=function(){var t=this,e=g.E...

r zn="toast",Xn="bs.toast",$n="."+Xn,Gn=g.fn[zn],Jn={CLICK_DISMISS:"click.dismiss"+$n,HIDE:"hide"+$n,HIDDEN:"hidden"+$n,SHOW:"show"+$n,SHOWN:"shown"+$n},Zn="fade",ti="hide",ei="show",ni="showing",ii={animation:"boolean",autohide:"boolean",delay:"number"},oi={animation:!0,autohide:!0,delay:500},ri='[data-dismiss="toast"]',si=function(){function i(t,e){this._element=t,this._config=this._getConfig(e),this._timeout=null,this._setListeners()}var t=i.prototype;return t.show=function(){var t=this,e=g.E...

    ```Python hl_lines="62-65"
    {!> ../../../docs_src/security/tutorial005.py!}
    ```

Because we are now declaring those scopes, they will show up in the API docs when you log-in/authorize.

And you will be able to select which scopes you want to give access to: `me` and `items`.

This is the same mechanism used when you give permissions while logging in with Facebook, Google, GitHub, etc: