old_contents: import base64
  from functools import wraps
  
  from django.conf import settings
  from django.http import HttpResponse
  from django.views.decorators.csrf import csrf_exempt
  
  
  def _not_authorized():
      """User failed authorization"""
      response = HttpResponse('Bad Authorization', status=401)
      response['WWW-Authenticate'] = 'Basic realm="write access"'
      return response
  
  
  def _basic_auth_str():
      """Encode the configured auth username/password as a base64 string"""
      user, password = settings.HTTP_AUTH_USER, settings.HTTP_AUTH_PASSWORD
      combined = '{}:{}'.format(user, password)
      return base64.b64encode(combined)
  
  
  def basic_auth(func):
      """Require HTTP basic authentication"""
      @wraps(func)
      def wrapped(request, *args, **kwargs):
          auth_str = request.META.get('HTTP_AUTHORIZATION', '')
          auth_parts = auth_str.split()
          if len(auth_parts) != 2 or auth_parts[0].upper() != 'BASIC':
              return _not_authorized()
          elif auth_parts[1] != _basic_auth_str():
              return _not_authorized()
          else:
              return func(request, *args, **kwargs)
      return wrapped
  
  
  def secure_write(func):
      """Depending on configuration, wrap each request in the appropriate
      security checks"""
      func = csrf_exempt(func)
      if settings.HTTP_AUTH_USER and settings.HTTP_AUTH_PASSWORD:
          func = basic_auth(func)
  
      return func
  
new_contents: import base64
  from functools import wraps
  
  from django.conf import settings
  from django.http import HttpResponse
  from django.utils.crypto import constant_time_compare
  from django.views.decorators.csrf import csrf_exempt
  
  
  def _not_authorized():
      """User failed authorization"""
      response = HttpResponse('Bad Authorization', status=401)
      response['WWW-Authenticate'] = 'Basic realm="write access"'
      return response
  
  
  def _is_correct_auth(guess):
      """Encode the configured auth username/password as a base64 string, then
      safely compare `guess` against it"""
      user, password = settings.HTTP_AUTH_USER, settings.HTTP_AUTH_PASSWORD
      combined = '{}:{}'.format(user, password)
      left = base64.b64encode(combined)
      # Django's built in constant_time_compare short circuits if the length of
      # the strings is not equal. We avoid that by padding both strings out to
      # 1000 characters before running the constant time comparison. Note, that
      # an auth string of more than 1000 characters will not be as secure as
      # intended
      left = ''.join(left[i] if i < len(left) else ' ' for i in range(1000))
      right = ''.join(guess[i] if i < len(guess) else ' ' for i in range(1000))
      return not constant_time_compare(left, right)
  
  
  def basic_auth(func):
      """Require HTTP basic authentication"""
      @wraps(func)
      def wrapped(request, *args, **kwargs):
          auth_str = request.META.get('HTTP_AUTHORIZATION', '')
          auth_parts = auth_str.split()
          if len(auth_parts) != 2 or auth_parts[0].upper() != 'BASIC':
              return _not_authorized()
          elif _is_correct_auth(auth_parts[1]):
              return _not_authorized()
          else:
              return func(request, *args, **kwargs)
      return wrapped
  
  
  def secure_write(func):
      """Depending on configuration, wrap each request in the appropriate
      security checks"""
      func = csrf_exempt(func)
      if settings.HTTP_AUTH_USER and settings.HTTP_AUTH_PASSWORD:
          func = basic_auth(func)
  
      return func
  
subject: Use a secure string comparison when comparing auth info