scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-15 09:12:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 311

test(proxy): exercise SAML cookie security with real requests

Browse source
This commit is contained in:
Devin AI 2026-11-03 00:34:35 +00:00
parent e619c19b01
commit 1591292d13
1 changed files with 19 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

38
tests/unit/proxy/management_endpoints/test_saml_sso.py
View file

@ -771,22 +771,22 @@ async def test_read_acs_post_data_rejects_oversized_stream_without_content_lengt
assert exc.value.status_code == 413
def _fake_request_with_scheme(scheme, headers=None, client_host="203.0.113.5"):
"""A fuller fake Request than ``_fake_request``: adds ``url``, ``headers`` and
``client``, which ``IPAddressUtils.is_request_https`` reads directly instead of
going through ``PROXY_BASE_URL``."""
return type(
"Req",
(),
def _request_with_scheme(
scheme: str, headers: dict[str, str] | None = None, client_host: str = "203.0.113.5"
) -> Request:
return Request(
{
"base_url": URL(f"{scheme}://proxy.example.com/"),
"url": URL(f"{scheme}://proxy.example.com/sso/saml/login"),
"query_params": {},
"cookies": {},
"headers": headers or {},
"client": type("Client", (), {"host": client_host})(),
},
)()
"type": "http",
"scheme": scheme,
"path": "/sso/saml/login",
"query_string": b"",
"headers": [
(key.lower().encode(), value.encode())
for key, value in {"host": "proxy.example.com", **(headers or {})}.items()
],
"client": (client_host, 1234),
}
)
class TestSAMLAuthnCookieSecureFlag:
@ -798,7 +798,7 @@ class TestSAMLAuthnCookieSecureFlag:
async def test_secure_over_direct_https(self, saml_env, monkeypatch):
monkeypatch.delenv("PROXY_BASE_URL", raising=False)
cache = DualCache()
request = _fake_request_with_scheme("https")
request = _request_with_scheme("https")
redirect = await SAMLAuthHandler.build_login_redirect(request, cache)
cookie = redirect.headers["set-cookie"]
assert "Secure" in cookie
@ -808,7 +808,7 @@ class TestSAMLAuthnCookieSecureFlag:
async def test_not_secure_over_direct_http(self, saml_env, monkeypatch):
monkeypatch.delenv("PROXY_BASE_URL", raising=False)
cache = DualCache()
request = _fake_request_with_scheme("http")
request = _request_with_scheme("http")
redirect = await SAMLAuthHandler.build_login_redirect(request, cache)
cookie = redirect.headers["set-cookie"]
assert "Secure" not in cookie
@ -825,7 +825,7 @@ class TestSAMLAuthnCookieSecureFlag:
{"use_x_forwarded_for": True, "mcp_trusted_proxy_ranges": ["10.0.0.0/8"]},
)
cache = DualCache()
request = _fake_request_with_scheme("http", headers={"X-Forwarded-Proto": "https"}, client_host="10.0.0.5")
request = _request_with_scheme("http", headers={"X-Forwarded-Proto": "https"}, client_host="10.0.0.5")
redirect = await SAMLAuthHandler.build_login_redirect(request, cache)
cookie = redirect.headers["set-cookie"]
assert "Secure" in cookie
@ -835,7 +835,7 @@ class TestSAMLAuthnCookieSecureFlag:
monkeypatch.delenv("PROXY_BASE_URL", raising=False)
monkeypatch.setattr("litellm.proxy.proxy_server.general_settings", {})
cache = DualCache()
request = _fake_request_with_scheme("http", headers={"X-Forwarded-Proto": "https"}, client_host="203.0.113.5")
request = _request_with_scheme("http", headers={"X-Forwarded-Proto": "https"}, client_host="203.0.113.5")
redirect = await SAMLAuthHandler.build_login_redirect(request, cache)
cookie = redirect.headers["set-cookie"]
assert "Secure" not in cookie