diff --git a/packages/hydrooj/src/handler/user.ts b/packages/hydrooj/src/handler/user.ts
index 4405008d0..30ca717a5 100644
--- a/packages/hydrooj/src/handler/user.ts
+++ b/packages/hydrooj/src/handler/user.ts
@@ -124,7 +124,7 @@ class UserLoginHandler extends Handler {
             this.limitRate('user_login', 60, 5),
             oplog.log(this, 'user.login', { redirect }),
         ]);
-        // if (udoc._tfa && !verifyToken(udoc._tfa, tfa)) throw new InvalidTokenError('2FA token invalid.');
+        if (udoc._tfa && !verifyToken(udoc._tfa, tfa)) throw new InvalidTokenError('2FA token invalid.');
         udoc.checkPassword(password);
         await user.setById(udoc._id, { loginat: new Date(), loginip: this.request.ip });
         if (!udoc.hasPriv(PRIV.PRIV_USER_PROFILE)) throw new BlacklistedError(uname);
diff --git a/packages/prom-client/index.ts b/packages/prom-client/index.ts
index 8f5f88b87..b243ca6d0 100644
--- a/packages/prom-client/index.ts
+++ b/packages/prom-client/index.ts
@@ -27,7 +27,7 @@ class MetricsHandler extends Handler {
             return;
         }
         const [name, password] = SystemModel.getMany(['prom-client.name', 'prom-client.password']);
-        const key = this.request.headers.authorization?.split('Basic ')?.[1];
+        const key = this.request.headers.authorization.split('Basic ')?.[1];
         if (!key || key !== Buffer.from(`${name}:${password}`).toString('base64')) {
             this.response.status = 403;
             this.response.body = {};