scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-11-13 08:52:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 175

fix(proxy): mask SSO client secrets in the /update/sso_settings response

Browse source
This commit is contained in:
jesus 2026-10-31 23:33:56 +00:00
parent 9331e97d36
commit e01c41bc90
2 changed files with 17 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
litellm/proxy/ui_crud_endpoints/proxy_setting_endpoints.py
View file

@ -1390,7 +1390,7 @@ async def update_sso_settings(
return {
"message": "SSO settings updated successfully",
"status": "success",
"settings": sso_data,
"settings": mask_sensitive_keys(sso_data, set(SSO_SECRET_FIELDS)),
}

23
tests/unit/proxy/ui_crud_endpoints/test_proxy_setting_endpoints.py
View file

@ -689,16 +689,11 @@ class TestProxySettingEndpoints:
# Verify settings were updated
settings = data["settings"]
assert settings["google_client_id"] == new_sso_settings["google_client_id"]
assert (
settings["google_client_secret"] == new_sso_settings["google_client_secret"]
)
assert settings["google_client_secret"] == "new_****************cret"
assert (
settings["microsoft_client_id"] == new_sso_settings["microsoft_client_id"]
)
assert (
settings["microsoft_client_secret"]
== new_sso_settings["microsoft_client_secret"]
)
assert settings["microsoft_client_secret"] == "new_*******************cret"
assert settings["proxy_base_url"] == new_sso_settings["proxy_base_url"]
assert settings["user_email"] == new_sso_settings["user_email"]
@ -831,6 +826,20 @@ class TestProxySettingEndpoints:
assert saved["generic_client_secret"] is None
assert os.environ["GENERIC_CLIENT_SECRET"] == "env-only-secret"
def test_update_sso_settings_response_masks_stored_secrets(
self, mock_proxy_config, mock_auth, monkeypatch
):
response, saved = self._patch_sso_settings(
monkeypatch, self._STORED_GENERIC_SSO, {}
)
assert response.status_code == 200
assert saved["generic_client_secret"] == "stored-client-secret"
returned = response.json()["settings"]
assert returned["generic_client_id"] == "stored-client-id"
assert returned["generic_client_secret"] != "stored-client-secret"
assert "stored-client-secret" not in response.text
def test_update_sso_settings_maps_saml_fields_to_env_vars(
self, mock_proxy_config, mock_auth, monkeypatch
):