scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-06 07:48:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 320

revert(terraform-provider): drop CheckRedirect header stripping

Browse source 
Headers are intentional; keep them on redirects. The 10-hop limit was
only Go's default reimplemented and added no value
This commit is contained in:
Matthijs Vogel 2026-08-10 20:12:24 +02:00
parent 00ec28d121
commit 58e6c746e6
No known key found for this signature in database
3 changed files with 6 additions and 60 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
terraform/provider/CHANGELOG.md
View file

@ -9,7 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Added
- **provider**: Optional `custom_headers` map to send extra HTTP headers on every LiteLLM API request (e.g. proxy or gateway headers). Applied by both request helpers. `x-api-key` from `api_key` always takes precedence. Cross-origin redirects drop custom headers and `x-api-key`
- **provider**: Optional `custom_headers` map to send extra HTTP headers on every LiteLLM API request (e.g. proxy or gateway headers). Applied by both request helpers. `x-api-key` from `api_key` always takes precedence
## [0.4.0] - 2026-08-06

26
terraform/provider/litellm/client.go
View file

@ -26,33 +26,17 @@ func NewClient(cfg ProviderConfig) *Client {
headers[k] = v
}
c := &Client{
return &Client{
APIBase: cfg.APIBase,
APIKey: cfg.APIKey,
InsecureSkipVerify: cfg.InsecureSkipVerify,
CustomHeaders: headers,
}
c.httpClient = &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify},
httpClient: &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: cfg.InsecureSkipVerify},
},
},
CheckRedirect: c.checkRedirect,
}
return c
}
func (c *Client) checkRedirect(req *http.Request, via []*http.Request) error {
if len(via) >= 10 {
return fmt.Errorf("stopped after 10 redirects")
}
orig := via[0].URL
if req.URL.Scheme != orig.Scheme || req.URL.Host != orig.Host {
for k := range c.CustomHeaders {
req.Header.Del(k)
}
req.Header.Del("x-api-key")
}
return nil
}
func (c *Client) applyRequestHeaders(req *http.Request) {

38
terraform/provider/litellm/client_test.go
View file

@ -2,7 +2,6 @@ package litellm
import (
"encoding/json"
"io"
"net/http"
"net/http/httptest"
"strings"
@ -73,43 +72,6 @@ func TestMakeRequestCustomHeaders(t *testing.T) {
}
}
func TestCrossOriginRedirectStripsSensitiveHeaders(t *testing.T) {
var finalAuth, finalAPIKey string
target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
finalAuth = r.Header.Get("X-Proxy-Auth")
finalAPIKey = r.Header.Get("x-api-key")
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(map[string]interface{}{"ok": true})
}))
defer target.Close()
origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if got := r.Header.Get("X-Proxy-Auth"); got != "proxy-token" {
t.Errorf("origin X-Proxy-Auth = %q, want proxy-token", got)
}
http.Redirect(w, r, target.URL+"/final", http.StatusFound)
}))
defer origin.Close()
client := testClient(origin.URL, "sk-real-key", false, map[string]string{
"X-Proxy-Auth": "proxy-token",
})
resp, err := MakeRequest(client, "GET", "/start", nil)
if err != nil {
t.Fatalf("MakeRequest: %v", err)
}
defer resp.Body.Close()
_, _ = io.Copy(io.Discard, resp.Body)
if finalAuth != "" {
t.Errorf("cross-origin redirect kept X-Proxy-Auth = %q", finalAuth)
}
if finalAPIKey != "" {
t.Errorf("cross-origin redirect kept x-api-key = %q", finalAPIKey)
}
}
func TestRedactSensitiveDataNestedCredentialValues(t *testing.T) {
c := testClient("http://localhost:4000", "sk-test", false, nil)