scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-24 00:52:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 91

fix(jwt): make _get_decode_options explicitly control verify_iss

Browse source 
Previously, _get_decode_options only set verify_aud based on whether
audience was provided. The issuer JWT path relied on always passing
issuer=issuer_config.issuer to trigger PyJWT's default verify_iss=True,
making the helper's behavior implicitly dependent on caller behavior.

Now _get_decode_options accepts issuer as well, mirroring the verify_aud
handling and matching the dimensions handled by _build_decode_kwargs.

Co-authored-by: Yassin Kortam <yassin@berri.ai>
This commit is contained in:
Cursor Agent 2026-05-21 19:51:03 +00:00
parent 064f31e826
commit 20e644748a
No known key found for this signature in database
1 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
litellm/proxy/auth/handle_jwt.py
View file

@ -968,11 +968,16 @@ class JWTHandler:
return jwk
def _get_decode_options(
self, audience: Optional[Union[str, List[str]]]
self,
audience: Optional[Union[str, List[str]]],
issuer: Optional[str] = None,
) -> Optional[dict]:
options: dict = {}
if audience is None:
return {"verify_aud": False}
return None
options["verify_aud"] = False
if issuer is None:
options["verify_iss"] = False
return options or None
def _decode_jwt_with_public_key(
self,
@ -985,7 +990,7 @@ class JWTHandler:
decode_options = (
options
if options is not None
else self._get_decode_options(audience=audience)
else self._get_decode_options(audience=audience, issuer=issuer)
)
if isinstance(public_key, dict):