当使用一个在数据库中不存在的用户名调用 `authenticate_user` 时，我们仍然会针对一个虚拟哈希运行 `verify_password`。

这可以确保无论用户名是否有效，端点的响应时间大致相同，从而防止可用于枚举已存在用户名的“时间攻击”（timing attacks）。

/// note | 注意

如果你查看新的（伪）数据库 `fake_users_db`，现在你会看到哈希后的密码类似这样：`"$argon2id$v=19$m=65536,t=3,p=4$wagCPXjifgvUFBzq4hqe3w$CYaIb8sB+wtD+Vu/P4uod1+Qof8h+1g7bbDlBID48Rc"`。

///

## 处理 JWT 令牌 { #handle-jwt-tokens }

      run: |
        function map() {
          # The "digest" that allows us to pull an image is not the digest as
          # returned by the API, but a sha256sum of the entire chunk of image
          # metadata. gcr.io helpfully includes it in the header of the response
          # as docker-content-digest: sha256:[digest]. Note we use egrep to
          # match exactly sha256:<hash> because curl may include a ^M symbol at

    void testRetriableExceptions() {
        // Test non-retriable errors
        SmbException accessDenied = new SmbException(NtStatus.NT_STATUS_ACCESS_DENIED, false);
        // Note: isRetriable() method does not exist in SmbException
        assertNotNull(accessDenied);

        SmbException notFound = new SmbException(NtStatus.NT_STATUS_OBJECT_NAME_NOT_FOUND, false);
        assertNotNull(notFound);

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * <p>
 * Resolves dependencies for the artifacts in context of the lifecycle build
 * </p>
 * <strong>NOTE:</strong> This class is not part of any public api and can be changed or deleted without prior notice.
 *
 * @since 3.0
 */
@Named
@Singleton
public class MojoDescriptorCreator {

                this.connectionState.set(0);
                this.tid = -1;

                // Clear any cached resources
                // Note: Most fields in SmbTreeImpl are final or managed differently

                // Clear session reference if mutable
                // Note: session field may be final, cannot be nulled
            }
        } catch (Exception e) {

但同時也傳入一個 `list` 的 scopes，這裡只有一個 scope：`items`（當然也可以有更多）。

而相依函式 `get_current_active_user` 也能宣告子相依性，不只用 `Depends`，也能用 `Security`。它宣告了自己的子相依函式（`get_current_user`），並加入更多 scope 要求。

在這個例子中，它要求 `me` 這個 scope（也可以要求多個）。

/// note

你不一定需要在不同地方加上不同的 scopes。

我們在這裡這樣做，是為了示範 FastAPI 如何處理在不同層級宣告的 scopes。

///

{* ../../docs_src/security/tutorial005_an_py310.py hl[5,141,172] *}

/// info | 技術細節

### Is concurrency better than parallelism? { #is-concurrency-better-than-parallelism }

Nope! That's not the moral of the story.

Concurrency is different than parallelism. And it is better on **specific** scenarios that involve a lot of waiting. Because of that, it generally is a lot better than parallelism for web application development. But not for everything.

So, to balance that out, imagine the following short story:

     * is evicted due to the cache's eviction strategy, and not as a result of manual {@linkplain
     * Cache#invalidate invalidations}.
     */
    void recordEviction();

    /**
     * Returns a snapshot of this counter's values. Note that this may be an inconsistent view, as
     * it may be interleaved with update operations.
     */
    CacheStats snapshot();

   * thrown by {@linkplain MoreExecutors#directExecutor direct execution}) will be caught and
   * logged.
   *
   * <p>Note: If your listener is lightweight -- and will not cause stack overflow by completing
   * more futures or adding more {@code directExecutor()} listeners inline -- consider {@link

<div class="termy">

```console
$ uvicorn main:app --host 0.0.0.0 --port 80

<span style="color: green;">INFO</span>:     Uvicorn running on http://0.0.0.0:80 (Press CTRL+C to quit)
```

</div>

/// note

指令 `uvicorn main:app` 指的是：

* `main`：檔案 `main.py`（Python「模組」）。
* `app`：在 `main.py` 中以 `app = FastAPI()` 建立的物件。

等同於：

```Python
from main import app
```

///