Surgical port to v1.83.10 patch series of upstream PR #28547 (merge
commit c854fc86). Replaces request.url.path with get_request_route() at
call sites whose path-based decisions must not be smuggled via the Host
header, since Starlette reconstructs url.path from the Host header but
FastAPI dispatches on scope["path"].
Mechanical substitutions applied (9 files, auto-merged):
- litellm/proxy/auth/auth_utils.py (docstring update only)
- litellm/proxy/auth/route_checks.py
- litellm/proxy/common_utils/http_parsing_utils.py
- litellm/proxy/health_endpoints/_health_endpoints.py
- litellm/proxy/litellm_pre_call_utils.py
- litellm/proxy/management_helpers/utils.py
- litellm/proxy/pass_through_endpoints/pass_through_endpoints.py
- litellm/proxy/spend_tracking/spend_management_endpoints.py
- litellm/proxy/vector_store_endpoints/utils.py
Conflicted files (manual surgical resolution):
- litellm/proxy/_experimental/mcp_server/auth/user_api_key_auth_mcp.py:
Replaced '.well-known' in str(request.url) (host-header vulnerable
substring check) with get_request_route(request).startswith(
'/.well-known/'). Dropped the upstream PR's other substitutions
(_target_servers_delegate_auth_to_upstream, _target_servers_use_oauth2,
ProxyException-union handler) because the call sites do not exist in
this branch.
- litellm/proxy/management_endpoints/mcp_management_endpoints.py:
No mechanical substitution applies. The upstream PR's only call site
for this file (_mcp_oauth_user_api_key_auth, an OAuth dependency for
/authorize and /token PKCE endpoints) does not exist in this branch.
Kept HEAD's sync _get_cached_temporary_mcp_server_or_404 unchanged.
- tests/proxy_unit_tests/test_proxy_routes.py:
Added the upstream PR's regression tests. The pkce_token_suffix case
exercises helper-level behavior only (no production call site for it
in this branch); kept for symmetry and helper coverage.
5255235eb3