scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-10 03:28:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 85

fix(proxy): propagate 5xx (HTTPException or ProxyException) instead of masking as 401 (Greptile)

Browse source
This commit is contained in:
Ishaan Jaff 2026-06-24 13:40:27 -07:00
parent 1faedc5f4d
commit 95e41e94f5
No known key found for this signature in database
1 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
litellm/proxy/auth/internal_auth_endpoints.py
View file

@ -138,12 +138,18 @@ async def verify_key(body: VerifyKeyRequest) -> dict[str, Any]:
auth = await user_api_key_auth(request=synthetic_request, api_key=bearer_key)
except (ProxyException, HTTPException) as exc:
# Expected auth failures (invalid / expired / over-budget / blocked) → 401
# with a minimal body so internals aren't leaked. Unexpected errors (e.g. a
# DB outage, misconfigured master key) surface as 5xx rather than
# masquerading as "invalid key" — the data plane still fails closed (it
# rejects any non-200 from this endpoint).
if isinstance(exc, HTTPException) and exc.status_code >= 500:
raise # let 5xx propagate so operators see the real error
# with a minimal body so internals aren't leaked. A 5xx (e.g. a DB outage
# surfaced as a 500, on either HTTPException.status_code or
# ProxyException.code) is NOT masked as "invalid key" — it propagates so
# operators see the real error. The data plane still fails closed: it
# rejects any non-200 from this endpoint.
status_code = getattr(exc, "status_code", None) or getattr(exc, "code", None)
try:
is_server_error = status_code is not None and int(status_code) >= 500
except (TypeError, ValueError):
is_server_error = False
if is_server_error:
raise
raise HTTPException(status_code=401, detail="invalid api key")
return auth.model_dump(exclude_none=True, mode="json")