diff --git a/internal/service/api/helpers.go b/internal/service/api/helpers.go
index 488cd8db..da8cf97b 100644
--- a/internal/service/api/helpers.go
+++ b/internal/service/api/helpers.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"net/http"
 	"sort"
@@ -77,7 +78,8 @@ func AuthMiddleware(tokenProvider func() string, storeAvailable func() bool) fun
 					respondError(w, http.StatusUnauthorized, "invalid_auth", "认证失败: 缺少 Authorization header")
 					return
 				}
-				if strings.TrimSpace(auth[7:]) != token {
+				provided := strings.TrimSpace(auth[7:])
+				if subtle.ConstantTimeCompare([]byte(provided), []byte(token)) != 1 {
 					respondError(w, http.StatusUnauthorized, "invalid_auth", "认证失败: 无效的认证令牌")
 					return
 				}
diff --git a/internal/service/server/server.go b/internal/service/server/server.go
index b1667edd..8768d667 100644
--- a/internal/service/server/server.go
+++ b/internal/service/server/server.go
@@ -1,6 +1,7 @@
 package server
 
 import (
+	"crypto/subtle"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -367,7 +368,8 @@ func checkAuth(r *http.Request, expectedToken string) bool {
 	if !strings.HasPrefix(auth, "Bearer ") {
 		return false
 	}
-	return strings.TrimSpace(auth[7:]) == expectedToken
+	provided := strings.TrimSpace(auth[7:])
+	return subtle.ConstantTimeCompare([]byte(provided), []byte(expectedToken)) == 1
 }
 
 func (s *Server) resolveModelOrFallback(modelName string) (*provider.ResolvedRoute, error) {