#### 「專業」的攻擊 { #a-professional-attack }

當然，攻擊者不會手動嘗試這一切，他們會寫程式來做，可能每秒進行上千或上百萬次測試，一次只多猜中一個正確字母。

但這樣做，幾分鐘或幾小時內，他們就能在我們應用程式「協助」下，僅靠回應時間就猜出正確的使用者名稱與密碼。

#### 用 `secrets.compare_digest()` 修正 { #fix-it-with-secrets-compare-digest }

但在我們的程式碼中實際使用的是 `secrets.compare_digest()`。

簡而言之，將 `stanleyjobsox` 與 `stanleyjobson` 比較所花的時間，會與將 `johndoe` 與 `stanleyjobson` 比較所花的時間相同；密碼也一樣。

如此一來，在應用程式程式碼中使用 `secrets.compare_digest()`，就能安全地防禦這整類的安全攻擊。

#### Fix it with `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

But in our code we are actually using `secrets.compare_digest()`.

#### Das Problem beheben mittels `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

Aber in unserem Code verwenden wir tatsächlich `secrets.compare_digest()`.

///

## Guia Avançado de Usuário { #advanced-user-guide }

Há também um **Guia Avançado de Usuário** que você pode ler após esse **Tutorial - Guia de Usuário**.

#### Виправте за допомогою `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

Але в нашому коді ми насправді використовуємо `secrets.compare_digest()`.

Daz DeBoer <******@****.***> <******@****.***>
Daz DeBoer <******@****.***> <******@****.***>
Daz DeBoer <******@****.***> <******@****.***>
Daz DeBoer <******@****.***> <******@****.***>
Derek Eskens <******@****.***> <******@****.***>
Etienne Studer <******@****.***> <******@****.***>
Etienne Studer <******@****.***> <******@****.***>

 *       <li>Applies to main dependencies, profile dependencies, and plugin dependencies</li>
 *     </ul>
 *   </li>
 *   <li><strong>Subprojects List Removal</strong>: Removes redundant {@code <subprojects>} lists that match direct child directories</li>
 * </ul>
 *
 * <h3>Multi-Module Project Support</h3>
 * <ul>
 *   <li><strong>POM Discovery</strong>: Recursively discovers all POM files in the project structure</li>

                    maxTotalConnections, maxConnectionsPerRoute);
        }
    }

    /**
     * Converts POJO authentication configs to HC5 Hc5Authentication objects.
     * This method supports:
     * - Direct Hc5Authentication[] (returns as-is)
     * - WebAuthenticationConfig[] (converts to Hc5Authentication[])
     * - Hc4Authentication[] (converts for backward compatibility)
     *
     * @return the authentication array

            testBlock.setOverrideTimeout(5000);
            assertEquals(5000, testBlock.getOverrideTimeout());
        }

        @Test
        @DisplayName("Test digest property")
        void testDigestProperty() {
            testBlock.setDigest(mockDigest);
            assertEquals(mockDigest, testBlock.getDigest());
        }

        @Test

        dstIndex += writeHeaderWireFormat(dst, dstIndex);
        dstIndex += writeAndXWireFormat(dst, dstIndex);
        this.length = dstIndex - start;

        if (this.digest != null) {
            this.digest.sign(dst, this.headerStart, this.length, this, this.getResponse());
        }

        return this.length;
    }

    /*
     * We overload this because we want readAndXWireFormat to