Use constant time comparison in HTTP Basic Auth example

[zwass]

Using this security best-practice in the example will encourage users to do the same in their code.

[codecov]

Codecov Report

Merging #807 into master will not change coverage.
The diff coverage is n/a.

@@          Coverage Diff           @@
##           master   #807    +/-   ##
======================================
  Coverage     100%   100%            
======================================
  Files         286    289     +3     
  Lines        7466   7595   +129     
======================================
+ Hits         7466   7595   +129

Impacted Files	Coverage Δ
docs/src/openapi_callbacks/tutorial001.py	100% <0%> (ø)	⬆️
fastapi/security/oauth2.py	100% <0%> (ø)	⬆️
fastapi/encoders.py	100% <0%> (ø)	⬆️
fastapi/routing.py	100% <0%> (ø)	⬆️
fastapi/security/__init__.py	100% <0%> (ø)	⬆️
tests/test_inherited_custom_class.py	100% <0%> (ø)
tests/test_sub_callbacks.py	100% <0%> (ø)
.../test_security_oauth2_authorization_code_bearer.py	100% <0%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7a44540...343f8ed. Read the comment docs.

[tiangolo]

Thanks! Good idea 🔒

I'll review it thoroughly soon, as I would like to make it easy to understand for newbies as well, explaining what an HMAC is to developers, what "constant time" means, what a "time attack" means, why it matters, etc.

[tiangolo]

Thanks for your contribution @zwass ! I updated it a bit and merged it. 🎉 🔒 🍰

[zwass]

Great explanation. Thank you!

[StephenBrown2]

This needs parentheses around it, or change the comparison to or not:

Suggested change

	if not correct_username and correct_password:
	if not (correct_username and correct_password):

Otherwise, if the username is bad but the password is good, the check will pass, as well as if the username is good, the check will pass regardless of the password.
Example:
https://repl.it/repls/WigglyLowestBackups

EDIT: Whoops, looks like this was fixed in #865. 👍 Truth tables are hard. :-)

[AntonGsv]

@tiangolo Why do you use secrets.compare_digest instead of hmac.compare_digest from the standard module?
secrets has its own dependency tree and some of them do not compile under windows.