scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-11 03:38:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 82

fix(proxy): point the FIPS scrypt rejection log at the admin reset path

Browse source 
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
This commit is contained in:
yucheng 2026-09-24 08:20:45 +00:00
parent 0660064397
commit d58958c577
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/utils.py
View file

@ -7097,9 +7097,8 @@ def verify_password(password: str, stored: str) -> bool:
if is_fips_mode():
verbose_proxy_logger.error(
"LITELLM_FIPS_MODE is on and this account still has a scrypt password hash, "
"which is not a FIPS approved primitive. Reset the password "
"(POST /user/password/change, or an admin POST /user/update with a new password) "
"so it is stored as pbkdf2 and the account can sign in"
"which is not a FIPS approved primitive. An admin must set a new password with "
"POST /user/update so it is stored as pbkdf2 and the account can sign in again"
)
return False
try:

2
tests/test_litellm/proxy/auth/test_password_hashing.py
View file

@ -72,7 +72,7 @@ class TestVerifyPasswordFormats:
with caplog.at_level(logging.ERROR, logger=verbose_proxy_logger.name):
assert verify_password("legacy-scrypt-pass", stored) is False
assert "scrypt" in caplog.text
assert "/user/password/change" in caplog.text
assert "/user/update" in caplog.text
def test_sha256_fallback_verifies_in_both_modes(self, monkeypatch):
stored = hashlib.sha256(b"oldpass").hexdigest()