Si el cliente solicita `http://example.com/items/foo` (un `item_id` `"foo"`), ese cliente recibirá un código de estado HTTP de 200, y un response JSON de:

```JSON
{
  "item": "The Foo Wrestlers"
}
```

Pero si el cliente solicita `http://example.com/items/bar` (un `item_id` inexistente `"bar"`), ese cliente recibirá un código de estado HTTP de 404 (el error "no encontrado"), y un response JSON de:

```JSON
{

```Python
if not (credentials.username == "stanleyjobson") or not (credentials.password == "swordfish"):
    # Return some error
    ...
```

Pero al usar `secrets.compare_digest()` será seguro contra un tipo de ataques llamados "timing attacks".

### Timing Attacks

¿Pero qué es un "timing attack"?

Imaginemos que algunos atacantes están tratando de adivinar el nombre de usuario y la contraseña.

  // Use fewer steps in the ListIteratorTester in ListListIteratorTester because it's slow in prod
  // mode.
  static int listListIteratorTesterNumIterations() {
    // TODO(hhchan): It's 4 in java.  Figure out why even 3 is too slow in prod mode.
    return 2;
  }

  // Use fewer steps in the IteratorTester in CollectionIteratorTester because it's slow in prod
  // mode.
  static int collectionIteratorTesterNumIterations() {
    return 3;
  }

# This script will not and should not be executed in the self hosted runner

echo "script failed" >resiliency-initial.log # assume initial state

echo "sleep to wait for MinIO Server to be ready prior mc commands"
# https://github.com/minio/mc/issues/3599

MINIO_SERVER_URL="http://127.0.0.1:9000"
ALIAS_NAME=myminio
BUCKET="test-bucket"
SRC_DIR="/tmp/data"
INLINED_DIR="/tmp/inlined"
DEST_DIR="/tmp/dest"

# Sobre HTTPS

Es fácil asumir que HTTPS es algo que simplemente está "activado" o no.

Pero es mucho más complejo que eso.

/// tip | Consejo

Si tienes prisa o no te importa, continúa con las siguientes secciones para ver instrucciones paso a paso para configurar todo con diferentes técnicas.

///

clone","setTime","local","getDateOffset","getTimezoneOffset","isUtc","aspNetRegex","isoRegex","createDuration","ret","diffRes","parseIso","base","isBefore","positiveMomentsDifference","momentsDifference","inp","isAfter","createAdder","direction","period","tmp","addSubtract","isAdding","invalid","subtract","isString","String","isMomentInput","arrayTest","dataTypeTest","filter","item","isNumberOrStringArray","property","objectTest","propertyTest","properties","isMomentInputObject","monthDiff","who...

Por ejemplo, el login de Google usa OpenID Connect (que internamente usa OAuth2).

Pero el login de Facebook no soporta OpenID Connect. Tiene su propia versión de OAuth2.

### OpenID (no "OpenID Connect")

Hubo también una especificación "OpenID". Que intentaba resolver lo mismo que **OpenID Connect**, pero no estaba basada en OAuth2.

Entonces, era un sistema completo adicional.

No es muy popular o usado hoy en día.

distribution.
   * Neither the name of Google Inc. nor the names of its
contributors may be used to endorse or promote products derived from
this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

   documentation and/or other materials provided with the distribution.
3. The names of the authors may not be used to endorse or promote products
   derived from this software without specific prior written permission.

THIS SOFTWARE IS PROVIDED BY THE AUTHORS ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * 3.2.3 and earlier are encouraged to use {@link JavaToolchainImpl}.
 * <strong>Note:</strong> This is an internal component whose interface can change without prior notice.
 *
 * @deprecated clients that do not require compatibility with Maven 3.2.3 and earlier should link to
 *             {@link JavaToolchainImpl} instead.
 */
@Deprecated