Skip to content

fix(proxy): forward extra headers in chat - #20386

Merged
Sameerlite merged 25 commits into
BerriAI:litellm_oss_staging_02_03_2026from
nehaaprasad:fix/extra-head-chat-comp-brid
Feb 4, 2026
Merged

fix(proxy): forward extra headers in chat#20386
Sameerlite merged 25 commits into
BerriAI:litellm_oss_staging_02_03_2026from
nehaaprasad:fix/extra-head-chat-comp-brid

Conversation

@nehaaprasad

Copy link
Copy Markdown
Contributor

Type: #20373

Changes

  • Proxy extra_headers were passed into the chat completions - responses bridge but never added to the request, so they were not sent upstream (e.g. Cloudflare auth).

  • The bridge now sets request_data["extra_headers"] = headers in transform_request() so those headers are forwarded to litellm.responses().

  • Added a test that transform_request includes the given headers as extra_headers in the returned request data.

yuneng-jiang and others added 25 commits February 2, 2026 19:04
adding together ai models to litellm models json
…BerriAI#20358)

* init A2AConfig

* add transform files

* feat: A2A

* feat A2AConfig

* fix get_secret_str

* init: A2AConfig

* init A2AConfig common utils

* A2AConfig

* test_a2a_completion_async_non_streaming

* fix

* Update litellm/main.py

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* add multi part conversation support

* extract_text_from_a2a_message

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* feat(ui): Add team-alias column to Models Health Status UI

- Added Team Alias column to the Models Health Status table
- Updated HealthCheckComponent to accept teams prop
- Updated health_check_columns to display team alias based on team_id
- Falls back to team_id if team alias not found, or shows '-' if no team
- Updated parent components to pass teams data to HealthCheckComponent

Co-authored-by: ishaan <ishaan@berri.ai>

* Update ui/litellm-dashboard/src/components/model_dashboard/health_check_columns.tsx

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: ishaan <ishaan@berri.ai>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
* test_a2a_registry_integration

* fix: render agents on model dropdown on UI

* init append_agents_to_model_group

* route_a2a_agent_request

* is_a2a_agent_model

* route_a2a_agent_request

* fix: error handling

* docs A2A usage

* docs fix

* feat: working A2a streaming

* fix transform
…_routes

[Feature] UI - Keys: Allowed Routes to Key Info and Edit Pages
…rriAI#20025)

AsyncHTTPHandler.__del__ was closing httpx clients still in use by
AsyncOpenAI/AsyncAzureOpenAI due to independent cache lifecycles.
Restores standalone httpx client creation for OpenAI/Azure providers.
[Fix] /user/update Allow for max_budget Resets
…hange

[Feature] UI - User Budget Page: Unlimited Budget Checkbox
…I#20383)

* fix: enforce team MCP permissions when using JWT authentication

Root cause: When JWT auth was used with teams in groups (via team_ids_jwt_field),
the team's MCP permissions were not being enforced because:

1. The default team_allowed_routes did not include mcp_routes
2. allowed_routes_check() failed for MCP endpoints like /mcp/tools/list
3. find_team_with_model_access() skipped the team due to failed route check
4. team_id was None in UserAPIKeyAuth
5. MCPRequestHandler._get_allowed_mcp_servers_for_team() returned empty list

Fix: Add 'mcp_routes' to the default team_allowed_routes in LiteLLM_JWTAuth.

This ensures that teams can access MCP endpoints by default, allowing the
team's MCP server permissions to be properly enforced.

Added tests:
- test_reproduce_jwt_mcp_enforcement_issue: Reproduces the exact bug scenario
- test_verify_mcp_routes_in_default_team_allowed_routes: Verifies fix
- test_mcp_route_check_passes_for_team: Verifies route check works

Co-authored-by: ishaan <ishaan@berri.ai>

* test: add comprehensive E2E tests for JWT + team MCP permission enforcement

Added tests:
- test_e2e_jwt_team_mcp_permissions_enforced: Full E2E test verifying JWT auth
  with teams in groups properly sets team_id and MCPRequestHandler returns
  the team's MCP servers
- test_e2e_jwt_without_team_no_mcp_servers: Verifies no MCP servers returned
  when JWT has no teams
- test_e2e_jwt_team_mcp_key_intersection: Verifies intersection logic when
  both key and team have MCP permissions (result = intersection)

These tests verify the complete flow:
1. JWT token with team in groups field
2. JWT auth properly sets team_id on UserAPIKeyAuth
3. MCPRequestHandler.get_allowed_mcp_servers() returns team's MCP servers
4. Key/team permission intersection works correctly

Co-authored-by: ishaan <ishaan@berri.ai>

* test: add simple tests for JWT + MCP permission enforcement

Simple, focused tests that validate:
1. test_simple_jwt_mcp_permissions_enforced: JWT user with team gets team's MCP servers
2. test_simple_jwt_no_team_no_mcp_servers: JWT user without team gets no MCP servers
3. test_simple_jwt_team_id_required_for_mcp_permissions: Verifies team_id is required
4. test_jwt_auth_sets_team_id_for_mcp_route: JWT auth sets team_id for MCP routes

These tests directly verify the core MCP permission enforcement logic works
when using JWT authentication with teams.

Co-authored-by: ishaan <ishaan@berri.ai>

* Add test: MCP route without model still returns team_id

Co-authored-by: ishaan <ishaan@berri.ai>

* Add 2 debug logs for JWT+MCP troubleshooting

- handle_jwt.py: Log team route check result (team_id, route, is_allowed)
- user_api_key_auth_mcp.py: Log team_id when looking up MCP permissions

Co-authored-by: ishaan <ishaan@berri.ai>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: ishaan <ishaan@berri.ai>
Add support for delete and GET via file_id for gemini
…eld_remoal

Fix: Extra inputs are not permitted, field: 'messages[2].provider_specific_fields
@vercel

vercel Bot commented Feb 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
litellm Ready Ready Preview, Comment Feb 4, 2026 3:31am

Request Review

@greptile-apps

greptile-apps Bot commented Feb 4, 2026

Copy link
Copy Markdown
Contributor

Greptile Overview

Greptile Summary

This PR fixes a bug where proxy extra_headers (like Cloudflare authentication tokens) were not being forwarded to upstream providers when using the chat completions to Responses API bridge.

Changes:

  • Added request_data["extra_headers"] = headers in transform_request() to forward headers to litellm.responses()
  • Added test to verify headers are properly included in the transformed request data

Impact:
The fix is minimal (3 lines) and directly addresses the issue. Headers are now correctly passed through the transformation bridge to the upstream API call.

Confidence Score: 5/5

  • This PR is safe to merge with minimal risk
  • The change is straightforward, well-tested, and directly fixes a documented bug. The 3-line addition properly forwards headers that were previously being ignored. Test coverage validates the fix.
  • No files require special attention

Important Files Changed

Filename Overview
litellm/completion_extras/litellm_responses_transformation/transformation.py Added 3 lines to forward headers as extra_headers in transform_request(). Simple, safe change that fixes header forwarding bug.
tests/test_litellm/completion_extras/test_litellm_responses_transformation_transformation.py Added test to verify headers are included in extra_headers field. Test is simple, focused, and validates the fix correctly.

Sequence Diagram

sequenceDiagram
    participant Client
    participant Proxy
    participant Handler as ResponsesToCompletionBridgeHandler
    participant Transform as LiteLLMResponsesTransformationHandler
    participant ResponsesAPI as litellm.responses()
    participant Upstream as LLM Provider

    Client->>Proxy: POST /chat/completions<br/>(headers: cf-aig-authorization, etc.)
    Proxy->>Proxy: Extract headers from request
    Proxy->>Handler: completion(messages, headers, ...)
    Handler->>Transform: transform_request(messages, headers, ...)
    Transform->>Transform: Convert messages to Responses API format
    Transform->>Transform: Build request_data dict
    Note over Transform: NEW: request_data["extra_headers"] = headers
    Transform-->>Handler: return request_data
    Handler->>ResponsesAPI: responses(**request_data)
    Note over ResponsesAPI: extra_headers unpacked from request_data
    ResponsesAPI->>Upstream: HTTP request with extra_headers
    Note over Upstream: Headers like cf-aig-authorization<br/>now forwarded correctly
    Upstream-->>ResponsesAPI: Response
    ResponsesAPI-->>Handler: ResponsesAPIResponse
    Handler->>Handler: Transform response to chat completion format
    Handler-->>Proxy: ModelResponse
    Proxy-->>Client: Chat completion response
Loading

@greptile-apps greptile-apps Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

2 files reviewed, no comments

Edit Code Review Agent Settings | Greptile

@Sameerlite Sameerlite left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Sameerlite
Sameerlite changed the base branch from main to litellm_oss_staging_02_03_2026 February 4, 2026 03:41
@Sameerlite
Sameerlite merged commit 25fa1ad into BerriAI:litellm_oss_staging_02_03_2026 Feb 4, 2026
5 of 8 checks passed
fzowl pushed a commit to fzowl/litellm that referenced this pull request Jun 24, 2026
…p-brid

fix(proxy): forward extra headers in chat
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants