{"record":{"id":"bd8b192458c6a9df","repo":"fatedier/frp","slug":"token-in-login-doesn-t-match-token-from-configurat","errorCode":null,"errorMessage":"token in login doesn't match token from configuration","messagePattern":"token in login doesn't match token from configuration","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/token.go","lineNumber":66,"sourceCode":"\n\tpingMsg.Timestamp = time.Now().Unix()\n\tpingMsg.PrivilegeKey = util.GetAuthKey(auth.token, pingMsg.Timestamp)\n\treturn nil\n}\n\nfunc (auth *TokenAuthSetterVerifier) SetNewWorkConn(newWorkConnMsg *msg.NewWorkConn) error {\n\tif !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeNewWorkConns) {\n\t\treturn nil\n\t}\n\n\tnewWorkConnMsg.Timestamp = time.Now().Unix()\n\tnewWorkConnMsg.PrivilegeKey = util.GetAuthKey(auth.token, newWorkConnMsg.Timestamp)\n\treturn nil\n}\n\nfunc (auth *TokenAuthSetterVerifier) VerifyLogin(m *msg.Login) error {\n\tif !util.ConstantTimeEqString(util.GetAuthKey(auth.token, m.Timestamp), m.PrivilegeKey) {\n\t\treturn fmt.Errorf(\"token in login doesn't match token from configuration\")\n\t}\n\treturn nil\n}\n\nfunc (auth *TokenAuthSetterVerifier) VerifyPing(m *msg.Ping) error {\n\tif !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeHeartBeats) {\n\t\treturn nil\n\t}\n\n\tif !util.ConstantTimeEqString(util.GetAuthKey(auth.token, m.Timestamp), m.PrivilegeKey) {\n\t\treturn fmt.Errorf(\"token in heartbeat doesn't match token from configuration\")\n\t}\n\treturn nil\n}\n\nfunc (auth *TokenAuthSetterVerifier) VerifyNewWorkConn(m *msg.NewWorkConn) error {\n\tif !slices.Contains(auth.additionalAuthScopes, v1.AuthScopeNewWorkConns) {\n\t\treturn nil","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/auth/token.go#L48-L84","documentation":"Static-token authentication check on frps. The expected key is md5hex(auth.token + decimal-timestamp) computed from the timestamp carried in the Login message, and compared with loginMsg.PrivilegeKey in constant time (util.ConstantTimeEqString). A mismatch means the frpc auth token differs from frps's, or the message was altered.","triggerScenarios":"frps has authentication.token = A and frpc sends md5(B + m.Timestamp) because its token is B; or a hand-rolled client computed the key over the wrong fields (the hash is token concatenated with the Unix timestamp as a decimal string, in that order).","commonSituations":"auth.token set on one side only (other side defaults to empty or a different default); trailing whitespace/quotes around the token in one config; copying configs between environments without updating the token; custom SDK clients hashing token and timestamp in the wrong order or using hex of the timestamp.","solutions":["Set the exact same authentication.token string on frps and frpc (and any visitor configs)","Check for invisible whitespace or quotes around the token in TOML/INI/YAML","If implementing the protocol yourself, compute md5(token || strconv.FormatInt(timestamp,10)) as lowercase hex and send the same timestamp in the Login message","Re-verify after editing both configs with a full frpc restart"],"exampleFix":"# frps.toml\nauthentication.method = \"token\"\nauthentication.token = \"my-secret\"\n\n# frpc.toml before\nauthentication.method = \"token\"\nauthentication.token = \"my-Secret\"   # case/typo mismatch\n\n# frpc.toml after\nauthentication.method = \"token\"\nauthentication.token = \"my-secret\"","handlingStrategy":"validation","validationCode":"if frpsToken != frpcToken {\n    return errors.New(\"auth.token mismatch between frps and frpc configs\")\n}\nexpected := md5hex(frpsToken + strconv.FormatInt(loginMsg.Timestamp, 10))\nif expected != loginMsg.PrivilegeKey { return errors.New(\"login key mismatch\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Manage auth.token in a single shared secret (vault/K8s secret) consumed by both sides","Diff the token values with 'cmp <(grep token frps.toml) <(grep token frpc.toml)' during setup","Avoid trailing whitespace/quotes when editing configs"],"tags":["frp","authentication","token","md5","config-mismatch"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}