mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-06 08:16:43 +00:00
c16c2cd6ee
* fix(proxy): mark session/SSO/SAML cookies Secure behind a TLS-terminating reverse proxy litellm only sees a plain-HTTP hop when TLS terminates at a reverse proxy, so cookie Secure attributes previously derived from (or defaulted without regard to) the literal request scheme could be dropped in production. The token session cookie set by every login path never carried Secure/HttpOnly/ SameSite at all. Adds IPAddressUtils.is_request_https, a single trust-aware resolver used by every cookie-setting call site: PROXY_BASE_URL, then X-Forwarded-Proto only from a configured trusted proxy (general_settings.use_x_forwarded_for + mcp_trusted_proxy_ranges), then the literal scheme. An unconfigured or untrusted caller cannot spoof the header to force Secure on. Resolves LIT-6748 * fix(proxy): make the shared session-cookie helper public, type new test helpers set_session_token_cookie is imported across modules (ui_sso.py -> proxy_server.py), so the leading underscore was misleading and breached basedpyright's reportPrivateUsage budget with zero headroom. Also adds missing parameter/return type annotations to the new test helper functions per repo convention. |
||
|---|---|---|
| .. | ||
| test_admin_viewer_handler_access.py | ||
| test_auth_checks.py | ||
| test_auth_exception_handler.py | ||
| test_auth_hot_path_network_requests.py | ||
| test_auth_utils.py | ||
| test_banned_params_extra_body.py | ||
| test_cli_auth.py | ||
| test_custom_auth_end_user_budget.py | ||
| test_fallback_model_access.py | ||
| test_handle_jwt.py | ||
| test_info_routes.py | ||
| test_litellm_license.py | ||
| test_login_utils.py | ||
| test_mcp_ip_filtering.py | ||
| test_model_access_group_budgets.py | ||
| test_model_checks.py | ||
| test_model_checks_fallbacks.py | ||
| test_multi_budget_windows.py | ||
| test_network.py | ||
| test_oauth2_proxy_hook.py | ||
| test_object_permission_loading.py | ||
| test_onboarding.py | ||
| test_organization_budget_enforcement.py | ||
| test_password_hashing.py | ||
| test_password_policy.py | ||
| test_resolvers_exceptions.py | ||
| test_resolvers_models.py | ||
| test_resolvers_seam.py | ||
| test_resolvers_store.py | ||
| test_route_checks.py | ||
| test_router_override_fallback_auth.py | ||
| test_team_member_budget.py | ||
| test_unmapped_model_budget_enforcement.py | ||
| test_user_api_key_auth.py | ||