{* ../../docs_src/security/tutorial005_an_py310.py hl[5,9,13,47,65,106,108:116,122:126,130:136,141,157] *}

Now let's review those changes step by step.

## OAuth2 Security scheme { #oauth2-security-scheme }

The first change is that now we are declaring the OAuth2 security scheme with two available scopes, `me` and `items`.

      - "https://server3-pool1:9000/mnt/disk{1...4}/"
      - "https://server4-pool1:9000/mnt/disk{1...4}/"
    set-drive-count: 4 # Advanced option, must be used under guidance from MinIO team.
```

### Things to know

- Fields such as `version` and `pools` are mandatory, however all other fields are optional.
- Each pool expects a minimum of 2 nodes per pool, and unique non-repeating hosts for each argument.

    }
    @RetainedLocalRef Object localValue = valueField;
    if (localValue != null & notInstanceOfDelegatingToFuture(localValue)) {
      return getDoneValue(localValue);
    }
    // we delay calling nanoTime until we know we will need to either park or spin
    long endNanos = remainingNanos > 0 ? System.nanoTime() + remainingNanos : 0;
    long_wait_loop:
    if (remainingNanos >= SPIN_THRESHOLD_NANOS) {
      Waiter oldHead = waitersField;

#### The time to answer helps the attackers { #the-time-to-answer-helps-the-attackers }

At that point, by noticing that the server took some microseconds longer to send the "Incorrect username or password" response, the attackers will know that they got _something_ right, some of the initial letters were right.

And then they can try again knowing that it's probably something more similar to `stanleyjobsox` than to `johndoe`.

Also, before that, in previous versions, the `request` object was passed as part of the key-value pairs in the context for Jinja2.

///

/// tip

By declaring `response_class=HTMLResponse` the docs UI will be able to know that the response will be HTML.

///

/// note | Technical Details

You could also use `from starlette.templating import Jinja2Templates`.

# Body - Multiple Parameters { #body-multiple-parameters }

Now that we have seen how to use `Path` and `Query`, let's see more advanced uses of request body declarations.

## Mix `Path`, `Query` and body parameters { #mix-path-query-and-body-parameters }

First, of course, you can mix `Path`, `Query` and request body parameter declarations freely and **FastAPI** will know what to do.

import okhttp3.OkHttpClient;
import okhttp3.Protocol;
import okhttp3.Request;
import okhttp3.Response;

/**
 * This prints events for a single in-flight call. It won't work for multiple concurrent calls
 * because we don't know what callStartNanos refers to.
 */
public final class PrintEventsNonConcurrent {
  private final OkHttpClient client = new OkHttpClient.Builder()
      .eventListener(new PrintingEventListener())
      .build();

Calls are executed in one of two ways:

 * **Synchronous:** your thread blocks until the response is readable.

- name: mangum
  html_url: https://github.com/Kludex/mangum
  stars: 1969
  owner_login: Kludex
  owner_html_url: https://github.com/Kludex
- name: Yuxi-Know
  html_url: https://github.com/xerrors/Yuxi-Know
  stars: 1849
  owner_login: xerrors
  owner_html_url: https://github.com/xerrors
- name: python-week-2022
  html_url: https://github.com/rochacbruno/python-week-2022
  stars: 1817

   * trouble, please let us know: https://github.com/google/guava/issues/new
   */
  @IgnoreJRERequirement
  public NullPointerTester() {
    try {
      /*
       * Converter.apply has a non-nullable parameter type but doesn't throw for null arguments. For
       * more information, see the comments in that class.
       *