mirror of
https://github.com/BerriAI/litellm.git
synced 2026-10-28 06:23:07 +00:00
984868bacd
The Langfuse pass-through route decoded the Authorization header before
authentication ran:
api_key = request.headers.get("Authorization") or ""
api_key = api_key.replace("Basic ", "")
decoded_bytes = base64.b64decode(api_key)
decoded_str = decoded_bytes.decode("utf-8")
api_key = decoded_str.split(":")[1]
With no header the value is "", which decodes to "", and `split(":")[1]` raises
IndexError. Non-base64 raises binascii.Error, non-utf8 bytes raise
UnicodeDecodeError, and a decoded value with no ":" raises IndexError again.
All five reach the client as HTTP 500 with a traceback in the proxy log, from an
unauthenticated request on a route registered for GET, POST, PUT, PATCH and
DELETE.
Parse the header in _extract_api_key_from_basic_auth, which returns "" for every
shape that carries no secret. user_api_key_auth then rejects the empty key with
the ordinary 401, so authentication decides the outcome rather than an exception
raised before it runs.
A secret containing ":" now survives whole: RFC 7617 puts everything after the
first colon in the password, and split(":")[1] truncated it to the first segment.
|
||
|---|---|---|
| .. | ||
| _support | ||
| audio_tests | ||
| base_sdk_tests | ||
| benchmarks | ||
| code_coverage_tests | ||
| documentation_tests | ||
| e2e | ||
| e2e_harness | ||
| fixtures | ||
| harness_e2e | ||
| integration | ||
| rust-python-harness | ||
| test_litellm_rust | ||
| typing | ||
| unit | ||
| windows_tests | ||
| __init__.py | ||
| _fake_openai_endpoint_server.py | ||
| _flush_vcr_cache.py | ||
| _live_test_helpers.py | ||
| _master_key.py | ||
| _openai_record_replay_proxy.py | ||
| _process_helpers.py | ||
| _vcr_conftest_common.py | ||
| _vcr_redis_persister.py | ||
| _wait_helpers.py | ||
| _ws_vcr.py | ||
| AGENTS.md | ||
| capturing_transport.py | ||
| eval_swe_bench.py | ||
| fake_openai_endpoint.py | ||
| gettysburg.wav | ||
| large_text.py | ||
| openai_batch_completions.jsonl | ||
| pyrightconfig.json | ||
| README.MD | ||
| test_logging.conf | ||
| test_rust_python_harness.py | ||
| VCR_TESTING.md | ||
| white_100x100.png | ||
In total litellm runs 1000+ tests
[02/20/2025] Update:
To make it easier to contribute and map what behavior is tested,
we've started mapping the litellm directory in tests/unit
This folder can only run mock tests.