Create form parameters the same way you would for `Body` or `Query`:

{* ../../docs_src/request_forms/tutorial001_an_py39.py hl[9] *}

For example, in one of the ways the OAuth2 specification can be used (called "password flow") it is required to send a `username` and `password` as form fields.

The <abbr title="specification">spec</abbr> requires the fields to be exactly named `username` and `password`, and to be sent as form fields, not JSON.

import org.jspecify.annotations.NullMarked;

/**
 * A Ticker whose value can be advanced programmatically in test.
 *
 * <p>The ticker can be configured so that the time is incremented whenever {@link #read} is called:
 * see {@link #setAutoIncrementStep}.
 *
 * <p>This class is thread-safe.
 *
 * @author Jige Yu
 * @since 10.0
 */
@NullMarked
@GwtCompatible
public class FakeTicker extends Ticker {

  }

  /**
   * Returns an iterable whose iterator returns the given elements in order. The elements are copied
   * out of the source collection at the time this method is called.
   */
  @SuppressWarnings("unchecked") // Es come in, Es go out
  public static <E extends @Nullable Object> MinimalIterable<E> from(Collection<E> elements) {
    return (MinimalIterable) of(elements.toArray());
  }

        } catch (Exception e) {
            // It's ok if it fails, we just want to verify reset was called
        }

        // Request/response reset should happen on retry
        verify(req, atLeastOnce()).reset();
        verify(resp, atLeastOnce()).reset();
        // Verify disconnect was called on retry
        verify(c, atLeastOnce()).disconnect(eq(true));
    }

    @Test

      assertWrapsInterruptedException(expected);
    } finally {
      interruptenator.shutdown();
      Thread.interrupted();
    }
  }

  /**
   * awaitFullGc() is not quite as reliable a way to ensure calling of a specific finalize method as
   * the more direct await* methods, but should be reliable enough in practice to avoid flakiness of
   * this test. (And if it isn't, we'd like to know about it first!)
   */

        }
        tasks.named("publishLocalPublicationToLocalRepository") {
            dependsOn("signGradleDistributionPublication")
        }
    }
}

/**
 * Tasks that are called by the (currently separate) promotion build running on CI.
 */
tasks.register("promotionBuild") {
    description = "Build production distros, smoke test them and publish"
    group = "publishing"

		Options: cr.STSAssumeRoleOptions{
			AccessKey: accessKey,
			SecretKey: secretKey,
			Location:  "",
		},
	}

	value, err := assumeRole.Retrieve()
	if err != nil {
		c.Fatalf("err calling assumeRole: %v", err)
	}

	minioClient, err := minio.New(s.endpoint, &minio.Options{
		Creds:     cr.NewStaticV4(value.AccessKeyID, value.SecretAccessKey, value.SessionToken),
		Secure:    s.secure,

```Python
if not (credentials.username == "stanleyjobson") or not (credentials.password == "swordfish"):
    # Return some error
    ...
```

But by using the `secrets.compare_digest()` it will be secure against a type of attacks called "timing attacks".

### Timing Attacks { #timing-attacks }

But what's a "timing attack"?

Let's imagine some attackers are trying to guess the username and password.

	m.mu.Lock()
	defer m.mu.Unlock()
	for bucket, b := range m.buckets {
		b.deleteAll()
		delete(m.buckets, bucket)
	}
}

// checkMetacacheState should be used if data is not updating.
// Should only be called if a failure occurred.
func (o listPathOptions) checkMetacacheState(ctx context.Context, rpc *peerRESTClient) error {
	// We operate on a copy...
	o.Create = false
	c, err := rpc.GetMetacacheListing(ctx, o)

    /**
     * Sets the URL stream handler factory for the environment.  This
     * allows specification of the factory used in creating underlying
     * stream handlers.  This can be called once per JVM instance.
     *
     * @param factory The URL stream handler factory.
     */
    public static void setURLStreamHandlerFactory(final URLStreamHandlerFactory factory) {
        synchronized (PROTOCOL_HANDLERS) {