scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-14 23:21:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 156

fix(proxy): include requester IP in auth failure logs

Browse source
This commit is contained in:
Devin AI 2026-07-14 03:09:10 +00:00
parent bf501c38a5
commit 0fb8b871c8
2 changed files with 24 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
litellm/proxy/auth/auth_exception_handler.py
View file

@ -94,6 +94,14 @@ class UserAPIKeyAuthExceptionHandler:
request=request,
use_x_forwarded_for=general_settings.get("use_x_forwarded_for", False),
)
request_metadata = request_data.get("metadata")
request_data_with_ip = {
**request_data,
"metadata": {
**(request_metadata if isinstance(request_metadata, dict) else {}),
"requester_ip_address": requester_ip,
},
}
verbose_proxy_logger.exception(
"litellm.proxy.proxy_server.user_api_key_auth(): Exception occured - {}\nRequester IP Address:{}".format(
str(e),
@ -134,7 +142,7 @@ class UserAPIKeyAuthExceptionHandler:
# Allow callbacks to transform the error response
transformed_exception = await proxy_logging_obj.post_call_failure_hook(
request_data=request_data,
request_data=request_data_with_ip,
original_exception=e,
user_api_key_dict=user_api_key_dict,
error_type=ProxyErrorTypes.auth_error,

16
tests/test_litellm/proxy/auth/test_auth_exception_handler.py
View file

@ -423,6 +423,18 @@ async def test_auth_failure_without_resolved_identity_still_logs():
the handler must still log a usable object carrying the raw api key and
route, not crash on the missing identity."""
handler = UserAPIKeyAuthExceptionHandler()
request = Request(
{
"type": "http",
"method": "POST",
"path": "/v1/chat/completions",
"headers": [],
"client": ("203.0.113.42", 45678),
"scheme": "http",
"server": ("testserver", 80),
"query_string": b"",
}
)
with (
patch(
@ -445,7 +457,7 @@ async def test_auth_failure_without_resolved_identity_still_logs():
param=None,
code=status.HTTP_401_UNAUTHORIZED,
),
MagicMock(),
request,
{},
"/v1/chat/completions",
None,
@ -453,8 +465,10 @@ async def test_auth_failure_without_resolved_identity_still_logs():
)
logged = mock_hook.call_args[1]["user_api_key_dict"]
logged_request_data = mock_hook.call_args[1]["request_data"]
# Raw key must NOT land on the object — it would be promoted into telemetry
# as litellm.api_key.hash and leak a real sk-... to anyone reading the trace.
assert logged.api_key != "sk-unknown"
assert logged.api_key == UserAPIKeyAuth(api_key="sk-unknown").api_key
assert logged.request_route == "/v1/chat/completions"
assert logged_request_data["metadata"]["requester_ip_address"] == "203.0.113.42"