scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-08-28 05:25:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 36

fix(proxy): keep sk-shaped secrets stripped on no-master-key proxies

Browse source
This commit is contained in:
mateo-berri 2026-08-26 00:37:17 -07:00
parent 7abd82f5e8
commit be0cac1ca7
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
litellm/proxy/pass_through_endpoints/llm_passthrough_endpoints.py
View file

@ -1819,14 +1819,14 @@ def _is_authenticated_caller_secret(value: str, user_api_key_dict: UserAPIKeyAut
"""Whether a header value is the master key or the key ``user_api_key_auth`` stored as ``api_key``."""
from litellm.proxy.proxy_server import master_key
if master_key is None:
return False
normalized: Final = _normalize_credential_value(value)
if hmac.compare_digest(normalized.encode(), master_key.encode()):
if master_key is not None and hmac.compare_digest(normalized.encode(), master_key.encode()):
return True
authenticated_key: Final = user_api_key_dict.api_key
if authenticated_key is None:
return False
if master_key is None and not normalized.startswith("sk-"):
return False
stored_representation: Final = UserAPIKeyAuth._safe_hash_litellm_api_key(normalized) # pyright: ignore[reportPrivateUsage] # the exact transform auth applied when it stored api_key
return hmac.compare_digest(stored_representation.encode(), authenticated_key.encode())