[Infra] Merge dev branch

[yuneng-berri]

Relevant issues

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Type

🚄 Infrastructure

Changes

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 17, 2026 7:13pm

[greptile-apps]

Greptile Summary

This PR contains two targeted security hardening changes: (1) passthrough/utils.py introduces a blocklist of protected headers (authorization, api-key, x-goog-api-key, x-amz-* prefix, etc.) so that malicious clients cannot overwrite proxy-injected credentials via the x-pass-* header forwarding mechanism; (2) auth_utils.py tightens check_complete_credentials to reject empty strings, None, and whitespace-only values as API keys. Both fixes include unit tests, and the remaining diff is Black formatting cleanup.

Confidence Score: 5/5

Safe to merge — both security fixes are correct and well-tested, with no P0/P1 issues found.

The credential-injection fix in passthrough/utils.py is logically sound: prefix stripping is done before the protected-header lookup, case normalisation is applied correctly, and the frozenset membership + prefix check are both O(1). The check_complete_credentials tightening in auth_utils.py closes a real but narrow bypass (null/empty api_key treated as valid). All new code paths have matching unit tests. The single P2 note (missing cookie in the blocklist) is purely defensive and does not affect current providers.

No files require special attention.

Important Files Changed

Filename	Overview
litellm/passthrough/utils.py	Adds _PASS_THROUGH_PROTECTED_HEADERS frozenset and _PASS_THROUGH_PROTECTED_HEADER_PREFIXES to prevent credential injection via x-pass-* headers; lowercases stripped header name before lookup; logic is correct.
litellm/proxy/auth/auth_utils.py	Tightens check_complete_credentials to require api_key be a non-empty, non-whitespace string, closing a bypass where presence of the key (even with null/empty value) was previously sufficient.
tests/test_litellm/proxy/pass_through_endpoints/test_vertex_passthrough_load_balancing.py	Adds test_forward_headers_from_request_protected_headers_not_overwritten covering all protected header types and lowercase normalization; no real network calls.
tests/proxy_unit_tests/test_proxy_utils.py	Adds parametrized test for check_complete_credentials covering empty string, None, and whitespace cases; remaining changes are Black formatting only.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Incoming request header] --> B{starts with x-pass-?}
    B -- No --> C[Ignored or handled by forward_headers path]
    B -- Yes --> D[Strip prefix and lowercase to get actual_header_name]
    D --> E{In protected headers set or starts with x-amz-?}
    E -- Yes --> F[SKIP - proxy credential preserved]
    E -- No --> G[Forward header to upstream]

Loading

_{Reviews (1): Last reviewed commit: "Merge remote-tracking branch 'origin/lit..." | Re-trigger Greptile}

[greptile-apps]

cookie header not protected

cookie is absent from _PASS_THROUGH_PROTECTED_HEADERS. A client could send x-pass-cookie: session=<value> and have it forwarded to the upstream provider. For the current set of passthrough targets (Vertex AI, Anthropic, Bedrock) this is benign because they use API-key auth, but it's worth adding "cookie" defensively if any future upstream relies on session cookies — and it costs nothing to block it now.

Suggested change

	_PASS_THROUGH_PROTECTED_HEADERS: frozenset = frozenset(
	{
	"authorization",
	"api-key",
	"x-api-key",
	"x-goog-api-key",
	"host",
	"content-length",
	}
	)
	_PASS_THROUGH_PROTECTED_HEADERS: frozenset = frozenset(
	{
	"authorization",
	"api-key",
	"x-api-key",
	"x-goog-api-key",
	"host",
	"content-length",
	"cookie",
	}
	)

[codecov]

Codecov Report

❌ Patch coverage is 63.63636% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
litellm/passthrough/utils.py	77.77%	2 Missing ⚠️
litellm/proxy/auth/auth_utils.py	0.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!