fix: 修复 TLS ConnectionState、SPA 回退、健康检查与监听小问题

internal/httpx/metrics.go

@@ -1,6 +1,8 @@
 package httpx
 
 import (
+	"crypto/sha256"
+	"crypto/subtle"
 	"net/http"
 	"strings"
 )
@@ -16,7 +18,7 @@ func MetricsGate(token string, next http.Handler) http.Handler {
 		}
 		auth := r.Header.Get("Authorization")
 		const prefix = "Bearer "
-		if !strings.HasPrefix(auth, prefix) || auth[len(prefix):] != token {
+		if !strings.HasPrefix(auth, prefix) || !tokenEqual(auth[len(prefix):], token) {
 			w.WriteHeader(http.StatusUnauthorized)
 			return
 		}
@@ -27,3 +29,9 @@ func MetricsGate(token string, next http.Handler) http.Handler {
 		next.ServeHTTP(w, r)
 	})
 }
+
+func tokenEqual(got, want string) bool {
+	sumGot := sha256.Sum256([]byte(got))
+	sumWant := sha256.Sum256([]byte(want))
+	return subtle.ConstantTimeCompare(sumGot[:], sumWant[:]) == 1
+}