fix(api-server): reject a non-ASCII bearer token with 401 instead of crashing

[Drexuxux]

What?

_check_auth gates every OpenAI-compatible API server endpoint. It compared the client's raw bearer token against the configured key with hmac.compare_digest on two str values:

token = auth_header[7:].strip()
if hmac.compare_digest(token, self._api_key):   # both str
    return None

hmac.compare_digest raises TypeError: comparing strings with non-ASCII characters is not supported when given a str containing non-ASCII characters, and token comes straight from the Authorization header. So a request with a single non-ASCII byte in the key (a stray unicode char, a smart quote, a pasted BOM) raised an unhandled TypeError. Every endpoint calls _check_auth without a try/except, so the framework turned that into a 500 Internal Server Error instead of the intended 401 Invalid API key — a legitimate client with a mistyped key gets an inscrutable 500, and any request can force a 500 on the auth path.

Solution

Compare as bytes, matching web_server.py's dashboard-token check (hmac.compare_digest(auth.encode(), expected.encode())):

if hmac.compare_digest(token.encode(), self._api_key.encode()):
    return None

Encoding both sides keeps the timing-safe comparison and its semantics identical for valid keys, while a non-ASCII token now fails closed with a clean 401 instead of crashing.

How to test

1. pytest tests/gateway/test_api_server.py::TestAuth -q
2. Two new tests exercise _check_auth directly:
   • a Bearer token containing a non-ASCII byte must return a 401 response (and must not raise);
   • a non-ASCII configured key must still authenticate against its exact byte-for-byte value.
3. Re-run against the pre-fix code to confirm both new tests raise TypeError there.

Test results

• tests/gateway/test_api_server.py::TestAuth — 7 passed (5 existing + 2 new); existing valid/invalid/missing/malformed-header cases unchanged.
• Pre-fix, both new tests fail with TypeError: comparing strings with non-ASCII characters is not supported at the _check_auth comparison; post-fix they return a clean 401 / authenticate correctly.
• tests/gateway/test_api_server.py (full file) — 197 passed, 1 skipped, no new failures.

[teknium1]

Thanks for the focused API-server regression fix. The premise is verified on current main: gateway/platforms/api_server.py:1216-1220 extracts the raw Bearer header and compares two str values with hmac.compare_digest; the proposed byte comparison fixes that path and the added tests cover both rejection and valid Unicode-key behavior.

Problems

• The same unsafe input pattern remains in the webhook authentication boundary. gateway/platforms/webhook.py:930, :935, :978, :1002, and :1056 pass request-header strings to hmac.compare_digest; _handle_webhook calls this validation directly at :535 before its normal 401 branch. This leaves sibling public signature paths outside the fix.

Suggested changes

• Apply the byte-safe comparison to those webhook signature/token comparisons and add a regression test that malformed non-ASCII signature input is rejected without raising.

Automated hermes-sweeper review.

[teknium1]

Merged via PR #65697 — your commits from this PR and #65307 were cherry-picked onto current main with your authorship preserved in git log (rebase-merge). We widened the same fix to the remaining sibling compare_digest sites (msgraph clientState, WhatsApp Cloud verify-token + signature, feishu/raft/line/sms plugin adapters, code_execution RPC token) in a follow-up commit so the whole bug class is closed. Thanks!