From 02f08956a67f758d117cebff3e58bcf18a32687b Mon Sep 17 00:00:00 2001 From: htl-syterme Date: Fri, 11 Sep 2026 00:52:07 +0000 Subject: [PATCH] fix(custom_hooks): redact x-trust token after verification to prevent replay Redact x-trust token from metadata after verification. --- litellm/proxy/custom_hooks/x_trust_hook.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/litellm/proxy/custom_hooks/x_trust_hook.py b/litellm/proxy/custom_hooks/x_trust_hook.py index e1956af650c..76b61ce3537 100644 --- a/litellm/proxy/custom_hooks/x_trust_hook.py +++ b/litellm/proxy/custom_hooks/x_trust_hook.py @@ -59,6 +59,9 @@ class XTrustHook(CustomLogger): payload = self._verify(token) if token else None score = payload["score"] if payload else 0.0 trusted = payload is not None and score >= self.min_score + # Redact token after verification to prevent replay via logging + if "headers" in data.get("metadata", {}): + data["metadata"]["headers"].pop("x-trust", None) if "metadata" not in data: data["metadata"] = {} data["metadata"]["x_trust"] = {