scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-04 02:31:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 69

test(auth_v2): pin the mTLS forwarded-DN gate against XFF spoofing

Browse source 
The forwarded subject-DN trust gate keys on the raw socket peer and prefers a
verified TLS-layer cert:
- an untrusted peer cannot smuggle a forged DN by claiming a trusted address via
  X-Forwarded-For (the gate ignores XFF)
- a verified client cert from the ASGI TLS extension wins over a proxy-forwarded
  DN header

Full auth_v2 suite: 175 passing.
This commit is contained in:
Yassin Kortam 2026-06-10 20:29:03 -07:00
parent c9e7fd829c
commit a7f9d5d6b9
1 changed files with 24 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
tests/test_litellm/proxy/auth_v2/test_authenticators.py
View file

@ -436,6 +436,30 @@ async def test_mtls_forwarded_header_from_untrusted_peer_is_ignored():
assert await auth.authenticate(request) is None
async def test_mtls_forwarded_header_gate_ignores_spoofed_xff():
# the gate keys on the raw socket peer, not X-Forwarded-For: an untrusted peer
# cannot claim a trusted address via XFF to smuggle a forged DN header
auth = _mtls(MutualTLSConfig(enabled=True, forwarded_subject_header="x-client-dn"))
request = make_request(
headers={"x-client-dn": "CN=attacker", "x-forwarded-for": "10.0.0.5"},
client=("8.8.8.8", 4444),
)
assert await auth.authenticate(request) is None
async def test_mtls_prefers_verified_asgi_cert_over_forwarded_header():
# a genuinely verified client cert from the TLS layer wins over a proxy header
auth = _mtls(MutualTLSConfig(enabled=True, forwarded_subject_header="x-client-dn"))
request = make_request(
headers={"x-client-dn": "CN=from-header"},
client=("10.0.0.9", 1),
scope_extra={"extensions": {"tls": {"client_cert_name": "CN=from-tls"}}},
)
credential = await auth.authenticate(request)
assert credential is not None
assert credential.subject == "CN=from-tls"
async def test_mtls_forwarded_header_absent_returns_none():
auth = _mtls(MutualTLSConfig(enabled=True, forwarded_subject_header="x-client-dn"))
assert await auth.authenticate(make_request()) is None