From 8f31cddc73ab70935ceb0482970a0e70b04af2c2 Mon Sep 17 00:00:00 2001 From: Ryan Crabbe Date: Thu, 19 Mar 2026 21:28:15 -0700 Subject: [PATCH] fix: remove redundant .strip('\"') on cookie value Starlette's cookie_parser already calls http.cookies._unquote() which strips RFC 2109 double-quote wrapping before request.cookies.get() returns. --- litellm/proxy/management_endpoints/ui_sso.py | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/litellm/proxy/management_endpoints/ui_sso.py b/litellm/proxy/management_endpoints/ui_sso.py index 958bad6bf29..45df548101d 100644 --- a/litellm/proxy/management_endpoints/ui_sso.py +++ b/litellm/proxy/management_endpoints/ui_sso.py @@ -1318,11 +1318,9 @@ async def auth_callback(request: Request, state: Optional[str] = None): # noqa: request=request, key=key_id, existing_key=existing_key, result=result ) - # Control-plane cross-origin: read return_to from cookie - cp_return_to: Optional[str] = None - cookie_return_to = request.cookies.get("litellm_cp_return_to") - if cookie_return_to: - cp_return_to = cookie_return_to.strip('"') + # Control-plane cross-origin: read return_to from cookie. + # Starlette's cookie_parser already handles RFC 2109 unquoting. + cp_return_to: Optional[str] = request.cookies.get("litellm_cp_return_to") return await SSOAuthenticationHandler.get_redirect_response_from_openid( result=result,