That way, using `secrets.compare_digest()` in your application code, it will be safe against this whole range of security attacks.

### Return the error

After detecting that the credentials are incorrect, return an `HTTPException` with a status code 401 (the same returned when no credentials are provided) and add the header `WWW-Authenticate` to make the browser show the login prompt again:

func reliableRename(srcFilePath, dstFilePath, baseDir string) (err error) {
	if err = reliableMkdirAll(path.Dir(dstFilePath), 0o777, baseDir); err != nil {
		return err
	}

	i := 0
	for {
		// After a successful parent directory create attempt a renameAll.
		if err = Rename(srcFilePath, dstFilePath); err != nil {
			// Retry only for the first retryable error.
			if osIsNotExist(err) && i == 0 {
				i++
				continue

            }

            length = (length << 8) + octet;
        }
        while (++octetsPos < octetsCount);

        if (length >= limit && !isParsing)   // after all we must have read at least 1 byte
        {
            throw new IOException("corrupted stream - out of bounds length found: " + length + " >= " + limit);
        }

        return length;
    }

    interrupter.start();
    // this will happen once the interrupt has been set which means that
    // 1. the runner has been woken up
    // 2. the interrupter is stuck in the call the Thread.interrupt()

    // after some period of time the runner thread should become blocked on the task because it is
    // waiting for the slow interrupting thread to complete Thread.interrupt
    awaitBlockedOnInstanceOf(runner, InterruptibleTask.Blocker.class);

   * inbound data and send an early 400 before the request body completes.
   *
   * This test sends a slow request that is canceled by the server. It expects the response to still
   * be readable after the request stream is canceled.
   */
  @Disabled
  @Test
  fun serverCancelsRequestBodyAndSendsResponseBody() {
    client =
      client.newBuilder()
        .retryOnConnectionFailure(false)

   *       instance method of the passed-in proxy to be of a certain value yet the proxy isn't aware
   *       of the assumption, in which case the equality check before and after serialization will
   *       fail.
   *   <li>If the constructor or factory method takes a parameter that {@link
   *       AbstractPackageSanityTests} doesn't know how to construct, the test will fail.

  {{{./xref/org/apache/maven/model/interpolation/StringVisitorModelInterpolator.html}source}}).

  Notice that model interpolation happens <after> profile activation, and that profile activation doesn't benefit from every values:
  interpolation for file-based activation is limited to <<<$\{basedir}>>> (which was introduced in Maven 3 and is not deprecated

	} else if err := os.Remove(resultFile); err != nil {
		t.Fatalf("error removing CNI config file: %s", resultFile)
	}
	// Verify configuration is still valid after removal
	compareConfResult(resultFile, expectedOutputFile, t)
	t.Log("PASS: Istio CNI configuration still valid after removal")

	// Shutdown the install-cni
	cancel()
	wg.Wait()

	t.Logf("Check the cleanup worked")
	if chainedCNIPlugin {

  public void testSubList_originalListSetAffectsSubList() {
    List<E> subList = getList().subList(0, 1);
    getList().set(0, e3());
    assertEquals(
        "A set() call to a list after a sublist has been created "
            + "should be reflected in the sublist",
        singletonList(e3()),
        subList);
  }

  @ListFeature.Require(SUPPORTS_REMOVE_WITH_INDEX)

  public void testSubList_originalListSetAffectsSubList() {
    List<E> subList = getList().subList(0, 1);
    getList().set(0, e3());
    assertEquals(
        "A set() call to a list after a sublist has been created "
            + "should be reflected in the sublist",
        singletonList(e3()),
        subList);
  }

  @ListFeature.Require(SUPPORTS_REMOVE_WITH_INDEX)