[PR #5240] [CLOSED] fix: use ConstantTimeEqString for visitor auth key comparison #5198

New issue

Closed

opened 2026-05-05 14:56:31 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 14:56:31 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/fatedier/frp/pull/5240
Author: @karesansui-u
Created: 3/16/2026
Status: ❌ Closed

Base: dev ← Head: fix/visitor-auth-constant-time-compare

📝 Commits (1)

0d0d59c fix: use ConstantTimeEqString for visitor auth key comparison

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 server/visitor/visitor.go (+1 -1)

📄 Description

server/visitor/visitor.go compares the visitor auth key using !=,
while pkg/auth/token.go and pkg/nathole/controller.go use
util.ConstantTimeEqString() for the same GetAuthKey comparison.

This aligns the visitor auth path with the existing pattern.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/fatedier/frp/pull/5240 **Author:** [@karesansui-u](https://github.com/karesansui-u) **Created:** 3/16/2026 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `fix/visitor-auth-constant-time-compare` --- ### 📝 Commits (1) - [`0d0d59c`](https://github.com/fatedier/frp/commit/0d0d59cf5fcc2554639e78aab2434be89628ecaf) fix: use ConstantTimeEqString for visitor auth key comparison ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `server/visitor/visitor.go` (+1 -1) </details> ### 📄 Description `server/visitor/visitor.go` compares the visitor auth key using `!=`, while `pkg/auth/token.go` and `pkg/nathole/controller.go` use `util.ConstantTimeEqString()` for the same `GetAuthKey` comparison. This aligns the visitor auth path with the existing pattern. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>