Repository: VictoriaMetrics/VictoriaMetrics (Go)

Issue:
promauth/config.go computes wrong hash of auth headers
### Describe the bug

```golang
	hd := xxhash.New()
	for _, kv := range headers {
		hd.Sum([]byte(kv.key))
		hd.Sum([]byte("="))
		hd.Sum([]byte(kv.value))
		hd.Sum([]byte(","))
	}
	headersDigest := fmt.Sprintf("digest(headers)=%d", hd.Sum64())
```

the current implementation always get `digest(headers)=17241709254077376921` because `hd.Sum` does not mutate itself instead of `hd.Write`

### To Reproduce

```golang
import (
	"fmt"
	"testing"

	"github.com/cespare/xxhash/v2"
)

type header struct {
	key   string
	value string
}

func TestHash(t *testing.T) {
	for _, testCase := range [][]header{
		[]header{
			{
				key:   "X-Real",
				value: "123",
			},
		},
		[]header{
			// empty headers
		},
	} {
		hd := xxhash.New()
		for _, kv := range testCase {
			hd.Sum([]byte(kv.key))
			hd.Sum([]byte("="))
			hd.Sum([]byte(kv.value))
			hd.Sum([]byte(","))
		}
		headersDigest := fmt.Sprintf("digest(headers)=%d", hd.Sum64())
		if headersDigest != "digest(headers)=17241709254077376921" {
			t.Errorf("generate digest")
		}
	}
}

```

### Version

all 

### Logs

_No response_

### Screenshots

_No response_

### Used command-line flags

_No response_

### Additional information

_No response_


Discussion:
Nice find! Would you be up for sending a PR?
@makasim of course. PR is submitted here #8938 
The bugfix was included into [v1.117.1](https://docs.victoriametrics.com/changelog/#v11171), [v1.110.8](https://docs.victoriametrics.com/changelog/#v11108) and [v1.102.21](https://docs.victoriametrics.com/changelog/#v110221).



Patch:
diff --git a/docs/victoriametrics/changelog/CHANGELOG.md b/docs/victoriametrics/changelog/CHANGELOG.md
index d681c9d27fb4d..2f9e3e71ad7eb 100644
--- a/docs/victoriametrics/changelog/CHANGELOG.md
+++ b/docs/victoriametrics/changelog/CHANGELOG.md
@@ -21,6 +21,7 @@ See also [LTS releases](https://docs.victoriametrics.com/victoriametrics/lts-rel
 **Update Note 1:** `latest` and `stable` tags for docker images will no longer be updated. It is required to use specific version tags for docker images to continue receiving updates. See [#7336](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/7336) for details.
 
 * BUGFIX: [vmsingle](https://docs.victoriametrics.com/single-server-victoriametrics/), `vminsert` in [VictoriaMetrics cluster](https://docs.victoriametrics.com/cluster-victoriametrics/) and [vmagent](https://docs.victoriametrics.com/vmagent/): fixed duplication in Datadog sketches aggregation metrics. See [#8836](https://github.com/VictoriaMetrics/VictoriaMetrics/issues/8836) for details.
+* BUGFIX: [vmagent](https://docs.victoriametrics.com/vmagent/): fixed auth header always get the same hash. See [#8938](https://github.com/VictoriaMetrics/VictoriaMetrics/pull/8938) for details
 
 ## [v1.117.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.117.0)
 
diff --git a/lib/promauth/config.go b/lib/promauth/config.go
index e473d1db6b2a4..14e3b82d6287b 100644
--- a/lib/promauth/config.go
+++ b/lib/promauth/config.go
@@ -681,10 +681,10 @@ func (opts *Options) NewConfig() (*Config, error) {
 	}
 	hd := xxhash.New()
 	for _, kv := range headers {
-		hd.Sum([]byte(kv.key))
-		hd.Sum([]byte("="))
-		hd.Sum([]byte(kv.value))
-		hd.Sum([]byte(","))
+		hd.Write([]byte(kv.key))
+		hd.Write([]byte("="))
+		hd.Write([]byte(kv.value))
+		hd.Write([]byte(","))
 	}
 	headersDigest := fmt.Sprintf("digest(headers)=%d", hd.Sum64())
 


Test patch:
diff --git a/lib/promauth/config_test.go b/lib/promauth/config_test.go
index f6af2695fdd29..033cf51a485ca 100644
--- a/lib/promauth/config_test.go
+++ b/lib/promauth/config_test.go
@@ -739,3 +739,23 @@ func mustGenerateCertificates() ([]byte, []byte, []byte) {
 
 	return caPEM, certPEM, keyPEM
 }
+
+func TestConfigHeadersHash(t *testing.T) {
+	f := func(headers []string, resultExpected string) {
+		t.Helper()
+		opts := Options{
+			Headers: headers,
+		}
+		var err error
+		c, err := opts.NewConfig()
+		if err != nil {
+			t.Fatalf("create new config error: %v", err)
+		}
+		if c.headersDigest != resultExpected {
+			t.Fatalf("generate wrong hash; got %s want %s", c.headersDigest, resultExpected)
+		}
+	}
+	f(nil, "digest(headers)=17241709254077376921")
+	f([]string{"foo: bar"}, "digest(headers)=16063449615388042431")
+	f([]string{"foo: bar", "X-Forwarded-For: A-B:c"}, "digest(headers)=8240238594493248512")
+}