github-starred/frp

Fork 0

mirror of https://github.com/fatedier/frp.git synced 2026-05-15 16:15:49 -06:00

[GH-ISSUE #1815] Login verification bugs when using fp-multiuser #1432

New issue

Closed

opened 2026-05-05 12:54:28 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 12:54:28 -06:00

Owner

Originally created by @Erik-37 on GitHub (May 20, 2020).
Original GitHub issue: https://github.com/fatedier/frp/issues/1815

What version of frp are you using (./frpc -v or ./frps -v)?
0.32.1

What operating system and processor architecture are you using (go env)?
linux_amd64
darwin_amd64

Configures you used:
frps:

bind_addr = 0.0.0.0
bind_port = 7100
bind_udp_port = 7001

log_level = trace
enable_prometheus = true
dashboard_addr = 0.0.0.0
dashboard_port = 7300

vhost_http_port = 8080

[plugin.multiuser]
addr = 127.0.0.1:7200
path = /handler
ops = Login

token:

frpc1=123
frpc2=abc

frpc1

[common]
server_addr = x.x.x.x
server_port = 7100
user = frpc_worker1
meta_token = 123

admin_addr = 0.0.0.0
admin_port = 7400
admin_user = admin
admin_pwd = admin

[test_server]
type = stcp
local_ip = 127.0.0.1
local_port = 22

frpc2:

[common]
server_addr = x.x.x.x
server_port = 7100

[test_visitor]
type = stcp
role = visitor
server_name = test_server
bind_addr = 127.0.0.1
bind_port = 6000

Steps to reproduce the issue:

./fp-multiuser -l 127.0.0.1:7200 -f ./tokens
Delete user and meta_token,but it can be successful sign in frps.

Describe the results you expected:
login to server failed: invalid meta token

Originally created by @Erik-37 on GitHub (May 20, 2020). Original GitHub issue: https://github.com/fatedier/frp/issues/1815 **What version of frp are you using (./frpc -v or ./frps -v)?** 0.32.1 **What operating system and processor architecture are you using (`go env`)?** linux_amd64 darwin_amd64 **Configures you used:** frps: ``` [common] bind_addr = 0.0.0.0 bind_port = 7100 bind_udp_port = 7001 log_level = trace enable_prometheus = true dashboard_addr = 0.0.0.0 dashboard_port = 7300 vhost_http_port = 8080 [plugin.multiuser] addr = 127.0.0.1:7200 path = /handler ops = Login ``` token: ``` frpc1=123 frpc2=abc ``` frpc1 ``` [common] server_addr = x.x.x.x server_port = 7100 user = frpc_worker1 meta_token = 123 admin_addr = 0.0.0.0 admin_port = 7400 admin_user = admin admin_pwd = admin [test_server] type = stcp local_ip = 127.0.0.1 local_port = 22 ``` frpc2: ``` [common] server_addr = x.x.x.x server_port = 7100 [test_visitor] type = stcp role = visitor server_name = test_server bind_addr = 127.0.0.1 bind_port = 6000 ``` **Steps to reproduce the issue:** 1. ./fp-multiuser -l 127.0.0.1:7200 -f ./tokens 2. Delete user and meta_token,but it can be successful sign in frps. **Describe the results you expected:** login to server failed: invalid meta token

gitea-mirror closed this issue

2026-05-05 12:54:29 -06:00

gitea-mirror commented

2026-05-05 12:54:31 -06:00

Author

Owner

@brvphoenix commented on GitHub (May 20, 2020):

Modify the conditional logic in the this line and recompile it yourself.

From:
if c.tokens[content.User] == token {
to:
if (len(content.User) > 0 && len(token) > 0) && c.tokens[content.User] == token {

This modification will make it reject clients without the keywords "user" and "meta_token", and you can also test the self-compiled binaries of linux-amd64.
fp-multiuser-linux-amd64.zip

@brvphoenix commented on GitHub (May 20, 2020): Modify the conditional logic in the this [line](https://github.com/gofrp/fp-multiuser/blob/65586dc763a20c4f170edbf569333114665428d7/pkg/server/controller/op.go#L37) and recompile it yourself. From: `if c.tokens[content.User] == token {` to: `if (len(content.User) > 0 && len(token) > 0) && c.tokens[content.User] == token {` This modification will make it reject clients without the keywords "user" and "meta_token", and you can also test the self-compiled binaries of linux-amd64. [fp-multiuser-linux-amd64.zip](https://github.com/fatedier/frp/files/4655729/fp-multiuser-linux-amd64.zip)

gitea-mirror commented

2026-05-05 12:54:32 -06:00

Author

Owner

@Erik-37 commented on GitHub (May 20, 2020):

Modify the conditional logic in the this line and recompile it yourself.

From:
if c.tokens[content.User] == token {
to:
if (len(content.User) > 0 && len(token) > 0) && c.tokens[content.User] == token {

This modification will make it reject clients without the keywords "user" and "meta_token", and you can also test the self-compiled binaries of linux-amd64.
fp-multiuser-linux-amd64.zip

Great solution!!! thanks

@Erik-37 commented on GitHub (May 20, 2020): > Modify the conditional logic in the this [line](https://github.com/gofrp/fp-multiuser/blob/65586dc763a20c4f170edbf569333114665428d7/pkg/server/controller/op.go#L37) and recompile it yourself. > > From: > `if c.tokens[content.User] == token {` > to: > `if (len(content.User) > 0 && len(token) > 0) && c.tokens[content.User] == token {` > > This modification will make it reject clients without the keywords "user" and "meta_token", and you can also test the self-compiled binaries of linux-amd64. > [fp-multiuser-linux-amd64.zip](https://github.com/fatedier/frp/files/4655729/fp-multiuser-linux-amd64.zip) Great solution!!! thanks

gitea-mirror commented

2026-05-05 12:54:33 -06:00

Author

Owner

@fatedier commented on GitHub (May 21, 2020):

@brvphoenix Can you send a PR with your modification to fp-multiuser.

@fatedier commented on GitHub (May 21, 2020): @brvphoenix Can you send a PR with your modification to [fp-multiuser](https://github.com/gofrp/fp-multiuser).

gitea-mirror commented

2026-05-05 12:54:34 -06:00

Author

Owner

@brvphoenix commented on GitHub (May 21, 2020):

@fatedier
https://github.com/gofrp/fp-multiuser/pull/2

@brvphoenix commented on GitHub (May 21, 2020): @fatedier https://github.com/gofrp/fp-multiuser/pull/2