#### A "professional" attack { #a-professional-attack }

Of course, the attackers would not try all this by hand, they would write a program to do it, possibly with thousands or millions of tests per second. And they would get just one extra correct letter at a time.

But doing that, in some minutes or hours the attackers would have guessed the correct username and password, with the "help" of our application, just using the time taken to answer.

/// tip

This is how you would handle **passwords**. Receive them, but don't return them in the API.

You would also **hash** the values of the passwords before storing them, **never store them in plain text**.

///

The fields of `HeroCreate` are:

* `name`
* `age`

  // in the short hash. We saw that a mask of 0x7f would keep the 7-bit value 0x6f from a full
  // hashcode of 0x89abcdef. The imaginary `hash` value would then be the remaining top 25 bits,
  // 0x89abcd80. To this is added (or'd) the `next` value, which is an index within `entries`
  // (and therefore within `keys` and `values`) of another entry that has the same short hash

 *       suite()} method with {@code Suppress}. Would {@code FooTest} itself be suppressed, too?
 *   <li>In at least one case, a use of {@code sun.misc.FpUtils}, the test will not even
 *       <i>compile</i> against Android. Now, this might be an artifact of our build system, one
 *       that we could probably work around. Or we could manually strip the test from open-source

import jcifs.internal.smb2.rdma.RdmaMemoryRegion;

/**
 * DiSNI memory region implementation.
 *
 * This class would integrate with DiSNI to provide registered
 * memory regions for high-performance RDMA operations.
 *
 * Note: This is a skeleton implementation. A real implementation would
 * require proper DiSNI integration with actual memory registration.
 */
public class DisniMemoryRegion extends RdmaMemoryRegion {

```
.
├── app
│   ├── __init__.py
│   ├── main.py
│   └── test_main.py
```

The file `main.py` would have:

{* ../../docs_src/async_tests/main.py *}

The file `test_main.py` would have the tests for `main.py`, it could look like this now:

{* ../../docs_src/async_tests/test_main.py *}

## Run it { #run-it }

You can run your tests as usual via:

You could load it at the top level of the module/file, but that would also mean that it would **load the model** even if you are just running a simple automated test, then that test would be **slow** because it would have to wait for the model to load before being able to run an independent part of the code.

But every time we do:

```Python
Settings()
```

a new `Settings` object would be created, and at creation it would read the `.env` file again.

If the dependency function was just like:

```Python
def get_settings():
    return Settings()
```

we would create that object for each request, and we would be reading the `.env` file for each request. ⚠️

If it was in a type annotation we could have used the vertical bar, as:

```Python
some_variable: PlaneItem | CarItem
```

But if we put that in the assignment `response_model=PlaneItem | CarItem` we would get an error, because Python would try to perform an **invalid operation** between `PlaneItem` and `CarItem` instead of interpreting that as a type annotation.

Depending on your use case, you might prefer to use a different library, but if you asked me, I would probably suggest you try **Strawberry**.

Here's a small preview of how you could integrate Strawberry with FastAPI:

{* ../../docs_src/graphql/tutorial001.py hl[3,22,25] *}