    def validate_request(self, request):
        """If configured for webhook basic auth, validate request has correct auth."""
        if self.basic_auth:
            request_auth = get_request_basic_auth(request)
            # Use constant_time_compare to avoid timing attack on basic auth. (It's OK that any()
            # can terminate early: we're not trying to protect how many auth strings are allowed,
            # just the contents of each individual auth string.)
            auth_ok = any(constant_time_compare(request_auth, allowed_auth)
                          for allowed_auth in self.basic_auth)
            if not auth_ok:
                # noinspection PyUnresolvedReferences
                raise AnymailWebhookValidationFailure(
                    "Missing or invalid basic auth in Anymail %s webhook" % self.esp_name)
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.