diff --git a/webserver/whip.go b/webserver/whip.go
index 04b44b5..b5b2a70 100644
--- a/webserver/whip.go
+++ b/webserver/whip.go
@@ -295,7 +295,7 @@ func whipResourceHandler(w http.ResponseWriter, r *http.Request) {
 
 	if t := c.Token(); t != "" {
 		token := parseBearerToken(r.Header.Get("Authorization"))
-		if token != t {
+		if !group.ConstantTimeCompare(t, token) {
 			http.Error(w, "Forbidden", http.StatusForbidden)
 			return
 		}