From 791e598ad546639bb7757f176568adb3dabe3bbb Mon Sep 17 00:00:00 2001 From: joereyna Date: Wed, 11 Mar 2026 23:50:34 -0700 Subject: [PATCH] fix: add break on match and guard empty normalized_route in mapped route checks - Add break after match in user_api_key_auth.py loop to avoid unnecessary iterations over remaining mapped routes - Guard against normalized_route being empty when route == root_path exactly, which would otherwise match every mapped route via startswith("") - Apply same empty-string guard in pass_through_endpoints.py for consistency --- litellm/proxy/auth/user_api_key_auth.py | 9 ++++++--- .../pass_through_endpoints/pass_through_endpoints.py | 9 +++++---- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/litellm/proxy/auth/user_api_key_auth.py b/litellm/proxy/auth/user_api_key_auth.py index 40a1e250689..e57adfda05d 100644 --- a/litellm/proxy/auth/user_api_key_auth.py +++ b/litellm/proxy/auth/user_api_key_auth.py @@ -390,13 +390,16 @@ async def check_api_key_for_custom_headers_or_pass_through_endpoints( if root_path and root_path != "/": if route.startswith(root_path): normalized_route = route[len(root_path):] - for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: # type: ignore - if normalized_route.startswith(mapped_route): - is_mapped_pass_through_route = True + if normalized_route: # guard against route == root_path exactly + for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: # type: ignore + if normalized_route.startswith(mapped_route): + is_mapped_pass_through_route = True + break else: for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: # type: ignore if route.startswith(mapped_route): is_mapped_pass_through_route = True + break if is_mapped_pass_through_route: if request.headers.get("litellm_user_api_key") is not None: api_key = request.headers.get("litellm_user_api_key") or "" diff --git a/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py b/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py index 8d6a4c00b71..3c208fc8d30 100644 --- a/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py +++ b/litellm/proxy/pass_through_endpoints/pass_through_endpoints.py @@ -2065,10 +2065,11 @@ class InitPassThroughEndpointHelpers: if root_path and root_path != "/": if route.startswith(root_path): normalized_route = route[len(root_path):] - for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: - if normalized_route.startswith(mapped_route): - return True - # Route lacks expected prefix — not a mapped pass-through route + if normalized_route: # guard against route == root_path exactly + for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: + if normalized_route.startswith(mapped_route): + return True + # Route lacks expected prefix (or is exactly root_path) — not a mapped pass-through route else: for mapped_route in LiteLLMRoutes.mapped_pass_through_routes.value: if route.startswith(mapped_route):