fix(proxy): forward extra headers in chat - #20386
Merged
Sameerlite merged 25 commits intoFeb 4, 2026
Merged
Conversation
adding together ai models to litellm models json
…BerriAI#20358) * init A2AConfig * add transform files * feat: A2A * feat A2AConfig * fix get_secret_str * init: A2AConfig * init A2AConfig common utils * A2AConfig * test_a2a_completion_async_non_streaming * fix * Update litellm/main.py Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> * add multi part conversation support * extract_text_from_a2a_message --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* feat(ui): Add team-alias column to Models Health Status UI - Added Team Alias column to the Models Health Status table - Updated HealthCheckComponent to accept teams prop - Updated health_check_columns to display team alias based on team_id - Falls back to team_id if team alias not found, or shows '-' if no team - Updated parent components to pass teams data to HealthCheckComponent Co-authored-by: ishaan <ishaan@berri.ai> * Update ui/litellm-dashboard/src/components/model_dashboard/health_check_columns.tsx Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: ishaan <ishaan@berri.ai> Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* test_a2a_registry_integration * fix: render agents on model dropdown on UI * init append_agents_to_model_group * route_a2a_agent_request * is_a2a_agent_model * route_a2a_agent_request * fix: error handling * docs A2A usage * docs fix * feat: working A2a streaming * fix transform
…_routes [Feature] UI - Keys: Allowed Routes to Key Info and Edit Pages
…rriAI#20025) AsyncHTTPHandler.__del__ was closing httpx clients still in use by AsyncOpenAI/AsyncAzureOpenAI due to independent cache lifecycles. Restores standalone httpx client creation for OpenAI/Azure providers.
Chore: Antd Modal Deprecated Props
[Fix] /user/update Allow for max_budget Resets
…hange [Feature] UI - User Budget Page: Unlimited Budget Checkbox
…I#20383) * fix: enforce team MCP permissions when using JWT authentication Root cause: When JWT auth was used with teams in groups (via team_ids_jwt_field), the team's MCP permissions were not being enforced because: 1. The default team_allowed_routes did not include mcp_routes 2. allowed_routes_check() failed for MCP endpoints like /mcp/tools/list 3. find_team_with_model_access() skipped the team due to failed route check 4. team_id was None in UserAPIKeyAuth 5. MCPRequestHandler._get_allowed_mcp_servers_for_team() returned empty list Fix: Add 'mcp_routes' to the default team_allowed_routes in LiteLLM_JWTAuth. This ensures that teams can access MCP endpoints by default, allowing the team's MCP server permissions to be properly enforced. Added tests: - test_reproduce_jwt_mcp_enforcement_issue: Reproduces the exact bug scenario - test_verify_mcp_routes_in_default_team_allowed_routes: Verifies fix - test_mcp_route_check_passes_for_team: Verifies route check works Co-authored-by: ishaan <ishaan@berri.ai> * test: add comprehensive E2E tests for JWT + team MCP permission enforcement Added tests: - test_e2e_jwt_team_mcp_permissions_enforced: Full E2E test verifying JWT auth with teams in groups properly sets team_id and MCPRequestHandler returns the team's MCP servers - test_e2e_jwt_without_team_no_mcp_servers: Verifies no MCP servers returned when JWT has no teams - test_e2e_jwt_team_mcp_key_intersection: Verifies intersection logic when both key and team have MCP permissions (result = intersection) These tests verify the complete flow: 1. JWT token with team in groups field 2. JWT auth properly sets team_id on UserAPIKeyAuth 3. MCPRequestHandler.get_allowed_mcp_servers() returns team's MCP servers 4. Key/team permission intersection works correctly Co-authored-by: ishaan <ishaan@berri.ai> * test: add simple tests for JWT + MCP permission enforcement Simple, focused tests that validate: 1. test_simple_jwt_mcp_permissions_enforced: JWT user with team gets team's MCP servers 2. test_simple_jwt_no_team_no_mcp_servers: JWT user without team gets no MCP servers 3. test_simple_jwt_team_id_required_for_mcp_permissions: Verifies team_id is required 4. test_jwt_auth_sets_team_id_for_mcp_route: JWT auth sets team_id for MCP routes These tests directly verify the core MCP permission enforcement logic works when using JWT authentication with teams. Co-authored-by: ishaan <ishaan@berri.ai> * Add test: MCP route without model still returns team_id Co-authored-by: ishaan <ishaan@berri.ai> * Add 2 debug logs for JWT+MCP troubleshooting - handle_jwt.py: Log team route check result (team_id, route, is_allowed) - user_api_key_auth_mcp.py: Log team_id when looking up MCP permissions Co-authored-by: ishaan <ishaan@berri.ai> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: ishaan <ishaan@berri.ai>
Add support for delete and GET via file_id for gemini
…eld_remoal Fix: Extra inputs are not permitted, field: 'messages[2].provider_specific_fields
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
Greptile OverviewGreptile SummaryThis PR fixes a bug where proxy Changes:
Impact: Confidence Score: 5/5
|
| Filename | Overview |
|---|---|
| litellm/completion_extras/litellm_responses_transformation/transformation.py | Added 3 lines to forward headers as extra_headers in transform_request(). Simple, safe change that fixes header forwarding bug. |
| tests/test_litellm/completion_extras/test_litellm_responses_transformation_transformation.py | Added test to verify headers are included in extra_headers field. Test is simple, focused, and validates the fix correctly. |
Sequence Diagram
sequenceDiagram
participant Client
participant Proxy
participant Handler as ResponsesToCompletionBridgeHandler
participant Transform as LiteLLMResponsesTransformationHandler
participant ResponsesAPI as litellm.responses()
participant Upstream as LLM Provider
Client->>Proxy: POST /chat/completions<br/>(headers: cf-aig-authorization, etc.)
Proxy->>Proxy: Extract headers from request
Proxy->>Handler: completion(messages, headers, ...)
Handler->>Transform: transform_request(messages, headers, ...)
Transform->>Transform: Convert messages to Responses API format
Transform->>Transform: Build request_data dict
Note over Transform: NEW: request_data["extra_headers"] = headers
Transform-->>Handler: return request_data
Handler->>ResponsesAPI: responses(**request_data)
Note over ResponsesAPI: extra_headers unpacked from request_data
ResponsesAPI->>Upstream: HTTP request with extra_headers
Note over Upstream: Headers like cf-aig-authorization<br/>now forwarded correctly
Upstream-->>ResponsesAPI: Response
ResponsesAPI-->>Handler: ResponsesAPIResponse
Handler->>Handler: Transform response to chat completion format
Handler-->>Proxy: ModelResponse
Proxy-->>Client: Chat completion response
Sameerlite
changed the base branch from
main
to
litellm_oss_staging_02_03_2026
February 4, 2026 03:41
Sameerlite
merged commit Feb 4, 2026
25fa1ad
into
BerriAI:litellm_oss_staging_02_03_2026
5 of 8 checks passed
fzowl
pushed a commit
to fzowl/litellm
that referenced
this pull request
Jun 24, 2026
…p-brid fix(proxy): forward extra headers in chat
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type: #20373
Changes
Proxy extra_headers were passed into the chat completions - responses bridge but never added to the request, so they were not sent upstream (e.g. Cloudflare auth).
The bridge now sets request_data["extra_headers"] = headers in transform_request() so those headers are forwarded to litellm.responses().
Added a test that transform_request includes the given headers as extra_headers in the returned request data.