scriptoriumadmin/litellm
1
0
Fork 0
mirror of https://github.com/BerriAI/litellm.git synced 2026-10-04 02:31:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 70
litellm/tests/test_litellm/proxy/auth
History
Krrish Dholakia fdb55ab65b
fix: block client-side pricing injection via request body 
Authenticated clients could supply CustomPricingLiteLLMParams fields
(input_cost_per_token, output_cost_per_token, etc.) in the request body.
These were forwarded to register_model() in main.py, permanently mutating
the shared global litellm.model_cost dict for all users on the instance.

Adds all CustomPricingLiteLLMParams fields to _BANNED_REQUEST_BODY_PARAMS
so is_request_body_safe() rejects them before they reach completion().
New pricing fields added to CustomPricingLiteLLMParams are auto-covered.

Admin opt-in via allow_client_side_credentials or
configurable_clientside_auth_params still works as before.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
2026-05-13 21:29:26 -07:00
..
test_admin_viewer_handler_access.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_auth_checks.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_auth_exception_handler.py fix(auth): address CI regressions from centralization 2026-04-23 00:13:17 +00:00
test_auth_hot_path_network_requests.py fix: update docker test file to right path 2026-02-19 18:44:28 +05:30
test_auth_utils.py fix: block client-side pricing injection via request body 2026-05-13 21:29:26 -07:00
test_banned_params_extra_body.py Merge pull request #27898 from stuxf/chore/banned-params-extra-body-cover 2026-05-13 20:57:19 -07:00
test_cli_auth.py cover cli sso start validation 2026-04-29 17:25:32 -07:00
test_custom_auth_end_user_budget.py fix(auth): centralize common_checks to close authorization bypass 2026-04-23 00:04:42 +00:00
test_handle_jwt.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_info_routes.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_litellm_license.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_login_utils.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_mcp_ip_filtering.py Return Clear error message why no tools are available / IP Filtering occured 2026-02-26 09:56:44 +05:30
test_model_checks.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_model_checks_fallbacks.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_multi_budget_windows.py feat: multiple concurrent budget windows per API key and team (#24883) (#25109) 2026-04-06 14:02:04 -07:00
test_oauth2_proxy_hook.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_object_permission_loading.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_onboarding.py chore(auth): address onboarding review follow-ups 2026-04-29 19:10:30 -07:00
test_organization_budget_enforcement.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_password_hashing.py chore: fixes 2026-03-30 18:36:58 -07:00
test_route_checks.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_router_override_fallback_auth.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00
test_team_member_budget.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_unmapped_model_budget_enforcement.py style: run black formatter on files from main merge 2026-04-17 13:02:59 -07:00
test_user_api_key_auth.py [Infra] Promote internal staging to main (#27245) 2026-05-05 16:15:03 -07:00