"build-cache-example-client",
          "client-services",
          "composite-builds",
          "docs",
          "files",
          "model-reflect",
          "request-handler-worker",
          "security",
          "service-registry-impl",
          "stdlib-java-extensions",
          "tooling-api-builders"
        ],
        "parallelizationMethod": {
          "name": "TestDistribution"
        }
      },

もしセキュリティ上の欠陥がソースコードにあるならば、それは存在したままです。

ドキュメンテーションを非表示にするのは、単にあなたのAPIへのアクセス方法を難解にするだけでなく、同時にあなた自身の本番環境でのAPIのデバッグを困難にしてしまう可能性があります。単純に、 <a href="https://en.wikipedia.org/wiki/Security_through_obscurity" class="external-link" target="_blank">Security through obscurity</a> の一つの形態として考えられるでしょう。

もしあなたのAPIのセキュリティを強化したいなら、いくつかのよりよい方法があります。例を示すと、

* リクエストボディとレスポンスのためのPydanticモデルの定義を見直す。
* 依存関係に基づきすべての必要なパーミッションとロールを設定する。
* パスワードを絶対に平文で保存しない。パスワードハッシュのみを保存する。

    #   o environmentMap: map of environment files, the value is dir path (NotRequired)
    #   o diffIgnoredKeyList: list of ignored keys for differences (NotRequired)
    #   o maskedKeyList: list of masked keys for security (NotRequired)
    #   o isEnvOnlyFloatLeft: is it environment only? (and show as float-left?) (NotRequired)
    #   o extendsPropRequest: other request name of exnteds-properties (NotRequired)

See [CRIME TLS](https://en.wikipedia.org/wiki/CRIME) as an example of this.

Therefore, compression is disabled when encrypting by default, and must be enabled separately.

Consult our security experts on [SUBNET](https://min.io/pricing) to help you evaluate if
your setup can use this feature combination safely.

To enable compression+encryption use:

```bash

        auth.close();

        // Verify it's closed
        assertTrue(auth.isClosed());
        // Cannot check password after closing as it now throws IllegalStateException
        // This is actually good security practice - closed authenticators cannot be accessed

        // Verify multiple closes don't cause issues
        auth.close(); // Should be safe to call again
        assertTrue(auth.isClosed());
    }

## Использование `Depends` и не только { #using-depends-and-others }

Вы можете импортировать из `fastapi` и использовать в эндпоинте вебсокета:

* `Depends`
* `Security`
* `Cookie`
* `Header`
* `Path`
* `Query`

Они работают так же, как и в других FastAPI эндпоинтах/*операциях пути*:

{* ../../docs_src/websockets/tutorial002_an_py310.py hl[68:69,82] *}

    asynccontextmanager,
    contextmanager_in_threadpool,
)
from fastapi.dependencies.models import Dependant
from fastapi.exceptions import DependencyScopeError
from fastapi.logger import logger
from fastapi.security.oauth2 import SecurityScopes
from fastapi.types import DependencyCacheKey
from fastapi.utils import create_model_field, get_path_param_names
from pydantic import BaseModel
from pydantic.fields import FieldInfo

	if _, ok := metadata[strings.ToLower(xhttp.ContentType)]; !ok {
		metadata[strings.ToLower(xhttp.ContentType)] = "binary/octet-stream"
	}

	// https://github.com/google/security-research/security/advisories/GHSA-76wf-9vgp-pj7w
	for k := range metadata {
		if equals(k, xhttp.AmzMetaUnencryptedContentLength, xhttp.AmzMetaUnencryptedContentMD5) {
			delete(metadata, k)
		}
	}

import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.DisplayName;
import org.junit.jupiter.api.Test;

/**
 * Test class for NtlmPasswordAuthenticator security enhancements
 */
public class NtlmPasswordAuthenticatorSecurityTest {

    private NtlmPasswordAuthenticator authenticator;

    @BeforeEach
    public void setUp() {
        authenticator = null;
    }

package okhttp3

import assertk.assertThat
import assertk.assertions.isEqualTo
import assertk.assertions.isInstanceOf
import assertk.assertions.isNotSameAs
import java.io.IOException
import java.net.Proxy
import java.security.cert.X509Certificate
import java.time.Duration
import kotlin.test.assertFailsWith
import mockwebserver3.MockResponse
import mockwebserver3.MockWebServer
import mockwebserver3.SocketEffect.CloseSocket