From 5dba2c3def610b2b3593dc0197a1bf3311d08d66 Mon Sep 17 00:00:00 2001
From: shrey kharbanda <shreshth@berri.ai>
Date: Tue, 22 Sep 2026 02:07:04 +0000
Subject: [PATCH] fix(proxy): block Claude Platform workspace id aliases in
 request bodies without admin opt-in

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
---
 litellm/proxy/auth/auth_utils.py              |  4 ++++
 .../proxy/auth/test_auth_utils.py             | 24 +++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/litellm/proxy/auth/auth_utils.py b/litellm/proxy/auth/auth_utils.py
index ee012e65ab1..c002b2b9508 100644
--- a/litellm/proxy/auth/auth_utils.py
+++ b/litellm/proxy/auth/auth_utils.py
@@ -338,6 +338,10 @@ _BANNED_REQUEST_BODY_PARAMS: Final[tuple[str, ...]] = (
     # re-route the request's retention and accounting to any project
     # reachable with the deployment's shared AWS credentials.
     "aws_bedrock_project_id",
+    "workspace_id",
+    "aws_workspace_id",
+    "anthropic_workspace_id",
+    "anthropic-workspace-id",
     "bedrock_tags",
     # Provider-specific endpoint overrides that flow into the outbound
     # request via ``optional_params``. Same threat as ``api_base``:
diff --git a/tests/test_litellm/proxy/auth/test_auth_utils.py b/tests/test_litellm/proxy/auth/test_auth_utils.py
index 965acd57bf3..83ac56c4c85 100644
--- a/tests/test_litellm/proxy/auth/test_auth_utils.py
+++ b/tests/test_litellm/proxy/auth/test_auth_utils.py
@@ -2727,6 +2727,30 @@ class TestIsRequestBodySafeBlocksBedrockProjectOverride:
         )
 
 
+class TestIsRequestBodySafeBlocksClaudePlatformWorkspaceOverride:
+    @pytest.mark.parametrize(
+        "alias", ["workspace_id", "aws_workspace_id", "anthropic_workspace_id", "anthropic-workspace-id"]
+    )
+    def test_workspace_alias_in_request_body_is_rejected(self, alias):
+        with pytest.raises(ValueError, match=alias):
+            is_request_body_safe(
+                request_body={"model": "gpt-4", alias: "wrkspc_attacker"},
+                general_settings={},
+                llm_router=None,
+                model="gpt-4",
+            )
+
+    def test_admin_opt_in_proxy_wide_allows_workspace_id(self):
+        assert (
+            is_request_body_safe(
+                request_body={"model": "gpt-4", "workspace_id": "wrkspc_byok"},
+                general_settings={"allow_client_side_credentials": True},
+                llm_router=None,
+                model="gpt-4",
+            )
+            is True
+        )
+
 class TestIsRequestBodySafeBlocksRustOptIn:
     """``rust`` hands the whole call to the Rust core, which signs and sends
     with its own HTTP client rather than the one the deployment configured, and