scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-09-16 23:41:43 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 102

chore(proxy): drop restating docstrings on the passthrough header helpers and refresh the lazy OpenAPI snapshot

Browse source
This commit is contained in:
mateo-berri 2026-09-16 11:35:43 -07:00
parent 938702a3a7
commit 774fc6021b
3 changed files with 1 additions and 21 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/proxy/_lazy_openapi_snapshot.json
View file

@ -19346,7 +19346,7 @@
}
}
},
"description": "\n Unified rate-limit error.\n\n Every rate-limit condition surfaced by litellm \u2014 whether it originated from\n an upstream LLM provider, a vendor batch endpoint, or one of litellm's own\n proxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\n max-iterations, etc.) \u2014 is raised as an instance of this class.\n\n The :attr:`category` attribute lets callers distinguish the source. See\n :class:`RateLimitErrorCategory` for the available values.\n "
"description": "\nUnified rate-limit error.\n\nEvery rate-limit condition surfaced by litellm \u2014 whether it originated from\nan upstream LLM provider, a vendor batch endpoint, or one of litellm's own\nproxy-side limiters (parallel-requests, dynamic-rate, batch-rate, budget,\nmax-iterations, etc.) \u2014 is raised as an instance of this class.\n\nThe :attr:`category` attribute lets callers distinguish the source. See\n:class:`RateLimitErrorCategory` for the available values.\n"
},
"500": {
"content": {

2
litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
View file

@ -2059,7 +2059,6 @@ def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAut
def _caller_headers_without_litellm_secrets(
request: Request, user_api_key_dict: UserAPIKeyAuth, never_forwarded: frozenset[str]
) -> Mapping[str, str]:
"""Incoming headers minus the ones only LiteLLM consumes and minus whatever value authenticated the caller."""
incoming: Final = _safe_get_request_headers(request)
dropped_by_name: Final = never_forwarded.union(
(_MAPPED_ROUTE_CALLER_KEY_HEADER, *_operator_configured_caller_key_header_names())
@ -2088,7 +2087,6 @@ def _forwarded_headers_for_credentialless_vertex_passthrough(
def _upstream_headers_for_anthropic_route(
request: Request, user_api_key_dict: UserAPIKeyAuth, proxy_auth_header: Mapping[str, str] | None
) -> Mapping[str, str]:
"""Caller headers minus LiteLLM secrets, with the proxy's own Anthropic credential layered on top."""
caller_headers: Final = _caller_headers_without_litellm_secrets(
request, user_api_key_dict, _HEADERS_NEVER_FORWARDED_TO_ANTHROPIC
)

18
tests/test_litellm/proxy/pass_through_endpoints/test_llm_pass_through_endpoints.py
View file

@ -4288,24 +4288,6 @@ class TestVertexCredentiallessPassthroughVirtualKeyLeak:
class TestAnthropicPassthroughVirtualKeyLeak:
"""Regression coverage for LIT-3550.
``/anthropic/{endpoint}`` forwarded every incoming header to Anthropic, so the
header that carried the caller's LiteLLM virtual key (``Authorization``,
``x-api-key``, ``x-litellm-api-key``, or an operator-configured name) reached
Anthropic and was rejected there as an invalid credential, with or without a
proxy-side Anthropic key layered on top. The virtual key must never leave the
proxy: it is dropped by value from the headers Anthropic reads as credentials
(``Authorization`` / ``x-api-key``), the proxy-only credential headers are
dropped by name, a caller's own Anthropic credential still passes through, and
a request with neither a proxy credential nor a caller credential fails with a
clean 401 instead of reaching ``create_pass_through_route``.
The forwarded set is rebuilt the way ``pass_through_request`` builds it from
the captured ``create_pass_through_route`` kwargs, so a route that re-enables
``_forward_headers`` fails these tests the same way the original bug did.
"""
VKEY = "sk-litellm-victim-key"
PROXY_KEY = "sk-ant-api03-proxy-configured-key"
ENDPOINT = "v1/messages"