}

    /**
     * @param digest
     */
    public void setDigest(final SMBSigningDigest digest) {
        this.digest = digest;
    }

    /**
     * @return the digest
     */
    public SMBSigningDigest getDigest() {
        return this.digest;
    }

    /**
     * @return the context associated with this transport connection

            }
        }
        // digest
        final String digest = getSingleNodeValue(document, getDigestXpath(fessConfig, xpathConfigMap), node -> node);
        if (StringUtil.isNotBlank(digest)) {
            putResultDataBody(dataMap, fessConfig.getIndexFieldDigest(), digest);
        } else {
            putResultDataBody(dataMap, fessConfig.getIndexFieldDigest(),

#### 「專業」的攻擊 { #a-professional-attack }

當然，攻擊者不會手動嘗試這一切，他們會寫程式來做，可能每秒進行上千或上百萬次測試，一次只多猜中一個正確字母。

但這樣做，幾分鐘或幾小時內，他們就能在我們應用程式「協助」下，僅靠回應時間就猜出正確的使用者名稱與密碼。

#### 用 `secrets.compare_digest()` 修正 { #fix-it-with-secrets-compare-digest }

但在我們的程式碼中實際使用的是 `secrets.compare_digest()`。

簡而言之，將 `stanleyjobsox` 與 `stanleyjobson` 比較所花的時間，會與將 `johndoe` 與 `stanleyjobson` 比較所花的時間相同；密碼也一樣。

如此一來，在應用程式程式碼中使用 `secrets.compare_digest()`，就能安全地防禦這整類的安全攻擊。

        });
    }

    /**
     * Generates a hashed ID from the provided URL ID string.
     * Encodes special characters using URL encoding or Base64 encoding as needed,
     * then applies a message digest algorithm to create a unique hash.
     *
     * @param urlId the URL ID string to generate a hash for
     * @return a hashed ID string generated from the input URL ID
     */

#### Fix it with `secrets.compare_digest()` { #fix-it-with-secrets-compare-digest }

But in our code we are actually using `secrets.compare_digest()`.

    * A cookie.
* `http`: standard HTTP authentication systems, including:
    * `bearer`: a header `Authorization` with a value of `Bearer ` plus a token. This is inherited from OAuth2.
    * HTTP Basic authentication.
    * HTTP Digest, etc.
* `oauth2`: all the OAuth2 ways to handle security (called "flows").
    * Several of these flows are appropriate for building an OAuth 2.0 authentication provider (like Google, Facebook, X (Twitter), GitHub, etc):

                    return "alerts,roles";

                case FessConfig.INDEX_FIELD_CACHE:
                    return "cache";
                case FessConfig.INDEX_FIELD_DIGEST:
                    return "digest";
                case FessConfig.INDEX_FIELD_HOST:
                    return "host";
                case FessConfig.INDEX_FIELD_SITE:
                    return "site";

        if ("sha512".equalsIgnoreCase(digestAlgorithm)) {
            oneWay = OneWayCryptographer.createSha512Cryptographer();
        } else if ("md5".equalsIgnoreCase(digestAlgorithm)) {
            logger.warn("MD5 digest is deprecated due to its collision vulnerabilities. Please consider migrating to SHA-256. algorithm={}",
                    digestAlgorithm);
            oneWay = new OneWayCryptographer("MD5", OneWayCryptographer.ENCODING_UTF8);

            testBlock.setOverrideTimeout(5000);
            assertEquals(5000, testBlock.getOverrideTimeout());
        }

        @Test
        @DisplayName("Test digest property")
        void testDigestProperty() {
            testBlock.setDigest(mockDigest);
            assertEquals(mockDigest, testBlock.getDigest());
        }

        @Test

        // mimetype
        defaultDataMap.put(fessConfig.getIndexFieldMimetype(), mimeType);
        // title
        // content
        // cache
        // digest
        // host
        // site
        // url
        // anchor
        // content_length
        // last_modified
        // id
        // virtual_host