fix: enable Uvicorn proxy headers to fix SSO 307 redirect behind TLS-terminating proxies

When FORWARDED_ALLOW_IPS is set, enable Uvicorn's proxy_headers mode so
X-Forwarded-Proto is respected. Fixes SSO login broken by Starlette's
StaticFiles 307 redirect using http:// scheme behind reverse proxies.

Made-with: Cursor

litellm/proxy/proxy_cli.py

@@ -137,11 +137,15 @@ class ProxyInitializationHelpers:
         import litellm
         from litellm._logging import _get_uvicorn_json_log_config
 
-        uvicorn_args = {
+        forwarded_allow_ips = os.getenv("FORWARDED_ALLOW_IPS", None)
+        uvicorn_args: dict = {
             "app": "litellm.proxy.proxy_server:app",
             "host": host,
             "port": port,
         }
+        if forwarded_allow_ips is not None:
+            uvicorn_args["proxy_headers"] = True
+            uvicorn_args["forwarded_allow_ips"] = forwarded_allow_ips
         if log_config is not None:
             print(f"Using log_config: {log_config}")  # noqa
             uvicorn_args["log_config"] = log_config