想更完整地了解 `**user_dict`，請回到[**額外模型** 的文件](../extra-models.md#about-user-in-dict)。

///

## 回傳 token { #return-the-token }

`token` 端點的回應必須是 JSON 物件。

它應該有一個 `token_type`。在本例中，我們使用「Bearer」tokens，token 類型應該是「`bearer`」。

而且它還應該有一個 `access_token`，其值為包含我們存取權杖的字串。

在這個簡單示例中，我們會不安全地直接回傳相同的 `username` 當作 token。

/// tip

下一章你會看到真正安全的實作，包含密碼雜湊與 <abbr title="JSON Web Tokens - JSON 網頁權杖">JWT</abbr> tokens。

Das ist derselbe Mechanismus, der verwendet wird, wenn Sie beim Anmelden mit Facebook, Google, GitHub, usw. Berechtigungen erteilen:

<img src="/img/tutorial/security/image11.png">

## JWT-Token mit Scopes { #jwt-token-with-scopes }

Ändern Sie nun die Token-*Pfadoperation*, um die angeforderten Scopes zurückzugeben.

        jsonFileManager.emptyAcceptedApiChanges(jsonFile)

        then:
        jsonFile.text == nonExistentAcceptedApiChanges()
    }

    def "can clean non-existing API changes"() {
        given:
        jsonFile << nonExistentAcceptedApiChanges()

        when:
        jsonFileManager.emptyAcceptedApiChanges(jsonFile)

        then:
        jsonFile.text == nonExistentAcceptedApiChanges()
    }

/// info

This requires installing `a2wsgi` for example with `pip install a2wsgi`.

///

You need to import `WSGIMiddleware` from `a2wsgi`.

Then wrap the WSGI (e.g. Flask) app with the middleware.

And then mount that under a path.

{* ../../docs_src/wsgi/tutorial001_py310.py hl[1,3,23] *}

/// note

{* ../../docs_src/stream_data/tutorial002_py310.py ln[1:27] hl[3,12:13,25] *}

/// note | Technical Details

The other two variables, `image_base64` and `binary_image`, are an image encoded in Base64, and then converted to bytes, to then pass it to `io.BytesIO`.

Only so that it can live in the same file for this example and you can copy it and run it as is. 🥚

///

   * currently skipping MediumTests on Android, and we skip them by not making them present at
   * runtime at all. I could just make _this_ test a MediumTest, but then it wouldn't run on
   * Android.... The right long-term fix is probably to get MediumTests running under Android by
   * default and then suppress them strategically as needed.
   */
  public static final class ConcretePackageSanityTests extends AbstractPackageSanityTests {}

////

//// tab | Windows PowerShell

<div class="termy">

```console
$ Get-Command python

C:\Users\user\code\awesome-project\.venv\Scripts\python
```

</div>

If it shows the `python` binary at `.venv\Scripts\python`, inside of your project (in this case `awesome-project`), then it worked. 🎉

////

Then we use the request directly, and extract the body as `bytes`. This means that FastAPI won't even try to parse the request payload as JSON.

And then in our code, we parse that YAML content directly, and then we are again using the same Pydantic model to validate the YAML content:

これらの場合、型宣言でリストを使用して定義することができます。

重複したヘッダーのすべての値をPythonの`list`として受け取ることができます。

例えば、複数回出現する可能性のある`X-Token`のヘッダを定義するには、以下のように書くことができます:

{* ../../docs_src/header_params/tutorial003_an_py310.py hl[9] *}

その*path operation*と通信する際に、次のように2つのHTTPヘッダーを送信する場合:

```
X-Token: foo
X-Token: bar
```

レスポンスは以下のようになります:

```JSON
{
    "X-Token values": [
        "bar",
        "foo"
    ]
}
```

## まとめ { #recap }

### Single Container { #single-container }