From ef72e7b37dc66d0d755af8dd67934d6f2ae1824d Mon Sep 17 00:00:00 2001
From: mateo-berri <277851410+mateo-berri@users.noreply.github.com>
Date: Mon, 31 Aug 2026 12:32:00 -0700
Subject: [PATCH] fix(openai): require https for workload identity api_base
 targets

---
 litellm/llms/openai/workload_identity.py                       | 3 ++-
 .../test_litellm/llms/openai/test_openai_workload_identity.py  | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/litellm/llms/openai/workload_identity.py b/litellm/llms/openai/workload_identity.py
index be4d015af8a..8a914039bd0 100644
--- a/litellm/llms/openai/workload_identity.py
+++ b/litellm/llms/openai/workload_identity.py
@@ -71,7 +71,8 @@ def get_workload_identity_bearer_token(config: OpenAIWorkloadIdentityConfig) ->
 def _targets_openai_api(api_base: str | None) -> bool:
     if api_base is None:
         return True
-    return urlparse(api_base).hostname == _OPENAI_API_HOST
+    parsed: Final = urlparse(api_base)
+    return parsed.scheme == "https" and parsed.hostname == _OPENAI_API_HOST
 
 
 @lru_cache(maxsize=16)
diff --git a/tests/test_litellm/llms/openai/test_openai_workload_identity.py b/tests/test_litellm/llms/openai/test_openai_workload_identity.py
index d7257d6af89..852e499dc54 100644
--- a/tests/test_litellm/llms/openai/test_openai_workload_identity.py
+++ b/tests/test_litellm/llms/openai/test_openai_workload_identity.py
@@ -69,6 +69,9 @@ class TestResolveConfig:
     def test_openai_api_base_allows(self, wif_env: OpenAIWorkloadIdentityConfig) -> None:
         assert resolve_openai_workload_identity_config(api_key=None, api_base="https://api.openai.com/v1") == wif_env
 
+    def test_plaintext_http_api_base_disables(self, wif_env: OpenAIWorkloadIdentityConfig) -> None:
+        assert resolve_openai_workload_identity_config(api_key=None, api_base="http://api.openai.com/v1") is None
+
     def test_foreign_env_base_url_disables(
         self, wif_env: OpenAIWorkloadIdentityConfig, monkeypatch: pytest.MonkeyPatch
     ) -> None: