Repository navigation
fix(auth): deny userless keys with 403 instead of 503 - #3
Merged
Merged
Conversation
LiteLLM's /user/info returns 404 for valid keys with no user row (team, bare and service-account keys). RequireAdmin mapped that to a retryable 503. Treat the 404 as a non-admin caller so it gets 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
5 of 6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Valid LiteLLM keys with no user row get a retryable 503 from the HTTP connector instead of 403. That covers team keys, keys with no user or team, and service-account keys. LiteLLM's
/user/inforeturns 404 "User None not found" for them, andRequireAdminmaps every status other than 401 or 403 to 503.Found by a deep gauntlet run on BerriAI/litellm#43881 and reproduced against a real proxy and Postgres.
Fix
Gateway.authorizetreats a/user/info404 as a caller with no user row. It falls through to the existing "Only current LiteLLM proxy admins" 403. Other failures keep their current mapping.Tests
The stub gateway returns LiteLLM's 404 for a
team-keycredential. The HTTP transport test asserts that this key gets 403. The assertion fails on main with 503 and passes with the fix. The full suite passes with 87 tests.🤖 Generated with Claude Code