This page explains the authentication mechanisms and security features in frp. It covers how clients authenticate with the server, TLS encryption for control connections, and various security features like per-proxy encryption, dynamic token loading, and security policies.
frp uses a Setter/Verifier pattern for authentication. The client side uses a Setter to add authentication information to outgoing messages, while the server side uses a Verifier to validate incoming messages.
Sources: pkg/auth/auth.go25-29 pkg/auth/auth.go83-87 pkg/auth/oidc.go126-130 pkg/auth/oidc.go219-223
The Setter interface has three methods that add authentication to different message types:
SetLogin: Called when establishing the initial control connection pkg/auth/auth.go26SetPing: Called for heartbeat messages (if enabled in additionalScopes) pkg/auth/auth.go27SetNewWorkConn: Called when creating new work connections (if enabled in additionalScopes) pkg/auth/auth.go28The Verifier interface mirrors these methods to validate the authentication information on the server side pkg/auth/auth.go83-87
Sources: pkg/auth/auth.go42-81 pkg/auth/auth.go100-116
The authentication provider is created by NewAuthSetter or NewAuthVerifier based on the Method field. The BuildClientAuth and BuildServerAuth functions handle resolving dynamic ValueSource tokens into static strings before initializing the providers pkg/auth/auth.go42-62 pkg/auth/auth.go98-116
Token authentication is the default authentication method. Both client and server are configured with the same shared secret token.
The token is inserted into the PrivilegeKey field of messages. For TokenAuth, the same object acts as both Setter and Verifier, comparing the message's PrivilegeKey against the configured token.
The ValueSource mechanism allows credentials to be loaded dynamically from external sources.
Sources: pkg/config/v1/value_source.go26-50 pkg/config/v1/value_source.go102-114 pkg/config/v1/value_source.go138-158
The Resolve method for the file source reads the specified path and trims whitespace pkg/config/v1/value_source.go102-114
The Resolve method for the exec source executes a command with a context, capturing its standard output pkg/config/v1/value_source.go138-158
OpenID Connect (OIDC) authentication uses the Client Credentials Grant flow to obtain access tokens.
OidcAuthProvider implements a specialized oidcTokenSource that adapts to the Identity Provider's (IdP) behavior:
expires_in value, frp caches the token and reuses it until expiry pkg/auth/oidc.go114-119nonCachingTokenSource, fetching a fresh token for every request to avoid using stale credentials pkg/auth/oidc.go83-90 pkg/auth/oidc.go115The createOIDCHTTPClient function configures the transport for OIDC requests, supporting pkg/auth/oidc.go38-77:
trustedCAFile pkg/auth/oidc.go49-61InsecureSkipVerify for testing pkg/auth/oidc.go44-46On the server side, OidcAuthVerifier validates the token. It ensures that the sub (subject) claim remains consistent between the initial Login and subsequent Ping or NewWorkConn messages to prevent session hijacking pkg/auth/oidc_test.go28-37 pkg/auth/oidc_test.go54-68
TLS encrypts the control connection. frp supports standard TLS as well as a custom multiplexing byte.
The server can be configured to force TLS for all incoming control connections. The http.Server implementation in pkg/util/http/server.go supports TLS certificates and optional basic authentication middleware pkg/util/http/server.go77-87
The pkg/util/net/tls.go provides helpers for creating TLS configurations, including loading X509 key pairs and configuring Root CAs for client/server verification.
frp uses FeatureGate to manage the lifecycle of experimental features.
Alpha (disabled by default), Beta (disabled by default), and GA (enabled by default) pkg/policy/featuregate/feature_gate.go32-39Alpha feature pkg/policy/featuregate/feature_gate.go59Certain features are marked as Unsafe and require explicit opt-in via configuration or CLI flags.
UnsafeFeatures policy map.Sources: pkg/policy/featuregate/feature_gate.go63-80 pkg/vnet/controller.go39-53 pkg/policy/security/unsafe.go26-34
Sources:
Refresh this wiki