* Diese gibt ein Objekt vom Typ `HTTPBasicCredentials` zurück:
    * Es enthält den gesendeten `username` und das gesendete `password`.

{* ../../docs_src/security/tutorial006_an_py39.py hl[4,8,12] *}
Wenn Sie versuchen, die URL zum ersten Mal zu öffnen (oder in der Dokumentation auf den Button „Execute“ zu klicken), wird der Browser Sie nach Ihrem Benutzernamen und Passwort fragen:

{* ../../docs_src/security/tutorial005_an_py310.py hl[5,9,13,47,65,106,108:116,122:125,129:135,140,156] *}

Now let's review those changes step by step.

## OAuth2 Security scheme

{* ../../docs_src/advanced_middleware/tutorial001.py hl[2,6] *}

## `TrustedHostMiddleware`

Garante que todas as requisições recebidas tenham um cabeçalho `Host` corretamente configurado, a fim de proteger contra ataques de cabeçalho de host HTTP.

{* ../../docs_src/advanced_middleware/tutorial002.py hl[2,6:8] *}

Os seguintes argumentos são suportados:

You can serve static files automatically from a directory using `StaticFiles`.

## Use `StaticFiles`

* Import `StaticFiles`.
* "Mount" a `StaticFiles()` instance in a specific path.

{* ../../docs_src/static_files/tutorial001.py hl[2,6] *}

/// note | "Technical Details"

You could also use `from starlette.staticfiles import StaticFiles`.

{* ../../docs_src/first_steps/tutorial001.py hl[7] *}

This is a Python function.

It will be called by **FastAPI** whenever it receives a request to the URL "`/`" using a `GET` operation.

In this case, it is an `async` function.

---

You could also define it as a normal function instead of `async def`:

{* ../../docs_src/first_steps/tutorial003.py hl[7] *}

/// note

For example, to declare another response with a status code `404` and a Pydantic model `Message`, you can write:

{* ../../docs_src/additional_responses/tutorial001.py hl[18,22] *}

/// note

Keep in mind that you have to return the `JSONResponse` directly.

///

/// info

The `model` key is not part of OpenAPI.

You can use `jsonable_encoder` for that.

It receives an object, like a Pydantic model, and returns a JSON compatible version:

{* ../../docs_src/encoder/tutorial001_py310.py hl[4,21] *}

In this example, it would convert the Pydantic model to a `dict`, and the `datetime` to a `str`.

{* ../../docs_src/body_fields/tutorial001_an_py310.py hl[4] *}


/// warning

Notice that `Field` is imported directly from `pydantic`, not from `fastapi` as are all the rest (`Query`, `Path`, `Body`, etc).

///

## Declare model attributes

You can then use `Field` with model attributes:

{* ../../docs_src/body_fields/tutorial001_an_py310.py hl[11:14] *}

* Use that `security` with a dependency in your *path operation*.
* It returns an object of type `HTTPBasicCredentials`:
    * It contains the `username` and `password` sent.

{* ../../docs_src/security/tutorial006_an_py39.py hl[4,8,12] *}

When you try to open the URL for the first time (or click the "Execute" button in the docs) the browser will ask you for your username and password:

<img src="/img/tutorial/security/image12.png">

In this case, the original path `/app` would actually be served at `/api/v1/app`.

Even though all your code is written assuming there's just `/app`.

{* ../../docs_src/behind_a_proxy/tutorial001.py hl[6] *}