但預設情況下，一切都「直接可用」。

### 驗證 { #validation }

* 驗證大部分（甚至所有？）的 Python **資料型別**，包括：
    * JSON 物件 (`dict`)。
    * JSON 陣列 (`list`) 定義項目型別。
    * 字串 (`str`) 欄位，定義最小或最大長度。
    * 數字 (`int`, `float`) 與其最大值和最小值等。

* 驗證外來的型別，比如:
    * URL
    * Email
    * UUID
    * ...等等。

所有的驗證都由完善且強大的 **Pydantic** 處理。

### 安全性及身份驗證 { #security-and-authentication }

```
~ mc admin config set alias/ scanner
KEY:
scanner  manage namespace scanning for usage calculation, lifecycle, healing and more

ARGS:
delay     (float)     scanner delay multiplier, defaults to '10.0'
max_wait  (duration)  maximum wait time between operations, defaults to '15s'
cycle     (duration)  time duration between scanner cycles
```

{* ../../docs_src/response_model/tutorial004_py310.py hl[9,11:12] *}

* `description: Union[str, None] = None` (или `str | None = None` в Python 3.10) имеет значение по умолчанию `None`.
* `tax: float = 10.5` имеет значение по умолчанию `10.5`.
* `tags: List[str] = []` имеет значение по умолчанию пустого списка: `[]`.

но вы можете захотеть опустить их в результате, если они фактически не были сохранены.

Without a data validation system, you would have to do all the checks by hand, in code.

These features are what Marshmallow was built to provide. It is a great library, and I have used it a lot before.

But it was created before there existed Python type hints. So, to define every <dfn title="the definition of how data should be formed">schema</dfn> you need to use specific utils and classes provided by Marshmallow.

errors.property_required={0} is required.
errors.property_type_integer={0} must be an integer.
errors.property_type_long={0} must be a long.
errors.property_type_float={0} must be a float.
errors.property_type_double={0} must be a double.
errors.property_type_date={0} must be a date.
errors.property_type_array={0} must be an array.

errors.storage_file_upload_failure=Failed to upload {0}.

errors.property_required={0} is required.
errors.property_type_integer={0} must be an integer.
errors.property_type_long={0} must be a long.
errors.property_type_float={0} must be a float.
errors.property_type_double={0} must be a double.
errors.property_type_date={0} must be a date.
errors.property_type_array={0} must be an array.

errors.storage_file_upload_failure=Failed to upload {0}.

## Obtenir `username` et `password` { #get-the-username-and-password }

Nous allons utiliser les utilités de sécurité de **FastAPI** pour obtenir `username` et `password`.

OAuth2 spécifie que lorsqu'on utilise le « password flow » (ce que nous utilisons), le client/utilisateur doit envoyer des champs `username` et `password` en tant que données de formulaire.

## Obtenha o `username` e a `password` { #get-the-username-and-password }

É utilizado o utils de segurança da **FastAPI** para obter o `username` e a `password`.

OAuth2 especifica que ao usar o "password flow" (fluxo de senha), que estamos usando, o cliente/usuário deve enviar os campos `username` e `password` como dados do formulário.

fla.no
flakstad.no
flatanger.no
fldrv.com
flekkefjord.no
flesberg.no
flickr
flier.jp
flight.aero
flights
flir
flog.br
flop.jp
floppy.jp
flora.no
florence.it
floripa.br
florist
floro.no
florø.no
flowers
flt.cloud.muni.cz
flutterflow.app
fly
fly.dev
flå.no
fm
fm.br
fm.it
fm.jo
fm.no
fnc.fr-par.scw.cloud
fnd.br

# OAuth2 with Password (and hashing), Bearer with JWT tokens { #oauth2-with-password-and-hashing-bearer-with-jwt-tokens }

Now that we have all the security flow, let's make the application actually secure, using <abbr title="JSON Web Tokens">JWT</abbr> tokens and secure password hashing.

This code is something you can actually use in your application, save the password hashes in your database, etc.