From 400ff4ed2497b7ee5e485335b715c1efef193c49 Mon Sep 17 00:00:00 2001 From: shivam Date: Wed, 1 Apr 2026 20:02:00 -0700 Subject: [PATCH] fix: enable Uvicorn proxy headers to fix SSO 307 redirect behind TLS-terminating proxies When FORWARDED_ALLOW_IPS is set, enable Uvicorn's proxy_headers mode so X-Forwarded-Proto is respected. Fixes SSO login broken by Starlette's StaticFiles 307 redirect using http:// scheme behind reverse proxies. Made-with: Cursor --- litellm/proxy/proxy_cli.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/litellm/proxy/proxy_cli.py b/litellm/proxy/proxy_cli.py index c638e294268..bf9b9955ca3 100644 --- a/litellm/proxy/proxy_cli.py +++ b/litellm/proxy/proxy_cli.py @@ -137,11 +137,15 @@ class ProxyInitializationHelpers: import litellm from litellm._logging import _get_uvicorn_json_log_config - uvicorn_args = { + forwarded_allow_ips = os.getenv("FORWARDED_ALLOW_IPS", None) + uvicorn_args: dict = { "app": "litellm.proxy.proxy_server:app", "host": host, "port": port, } + if forwarded_allow_ips is not None: + uvicorn_args["proxy_headers"] = True + uvicorn_args["forwarded_allow_ips"] = forwarded_allow_ips if log_config is not None: print(f"Using log_config: {log_config}") # noqa uvicorn_args["log_config"] = log_config