fix(proxy): allow custom auth routes to bypass route authorization ch…

[Harshit28j]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Building	Preview, Comment	Mar 3, 2026 2:51pm

[greptile-apps]

Greptile Summary

This PR fixes a regression where custom user-defined auth routes (e.g., /ldap/ngs/ready) were being rejected by the standard route authorization checks in common_checks(). After _run_post_custom_auth_checks was introduced, custom auth handlers that return a UserAPIKeyAuth would then run through common_checks, which would reject unrecognized routes as unauthorized. The fix adds a skip_route_check parameter to common_checks(), set to True only in _run_post_custom_auth_checks, since the custom auth function has already validated the request and knows which routes are valid.

• Adds skip_route_check: bool = False parameter to common_checks() to conditionally skip _is_allowed_route enforcement
• Passes skip_route_check=True only in _run_post_custom_auth_checks, leaving all other call sites (JWT auth, key-based auth) unchanged
• Includes a regression test verifying that custom routes pass with skip_route_check=True and fail without it

Confidence Score: 4/5

• This PR is safe to merge — it's a targeted fix for a regression with minimal blast radius and includes a regression test.
• The change is small, well-scoped, and only affects the custom auth path. The skip_route_check parameter defaults to False, preserving existing behavior for all other callers (JWT and key-based auth). The custom auth function has already validated the request before this code path is reached, so skipping the route check is appropriate. A regression test is included.
• No files require special attention.

Important Files Changed

Filename	Overview
litellm/proxy/auth/auth_checks.py	Adds skip_route_check parameter to common_checks() and wraps the _is_allowed_route call in a conditional block. Clean, minimal change that doesn't affect other callers.
litellm/proxy/auth/user_api_key_auth.py	Passes skip_route_check=True to common_checks() in _run_post_custom_auth_checks, the only call site that handles custom auth flows.
tests/test_litellm/proxy/auth/test_auth_checks.py	Adds a regression test using mocks to verify custom routes pass with skip_route_check=True and fail without it. No real network calls.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Request arrives] --> B{Custom auth configured?}
    B -->|Yes| C[enterprise_custom_auth / user_custom_auth validates request]
    B -->|No| D[Standard JWT / Key-based auth]
    C --> E["_run_post_custom_auth_checks()"]
    E --> F["common_checks(skip_route_check=True)"]
    F --> G[Budget checks, team checks, etc.]
    G --> H[Skip _is_allowed_route]
    H --> I[Vector store checks]
    I --> J[Return True]
    D --> K["common_checks(skip_route_check=False)"]
    K --> L[Budget checks, team checks, etc.]
    L --> M["_is_allowed_route() — enforces route authorization"]
    M --> N[Vector store checks]
    N --> J

Loading

_{Last reviewed commit: 6d535e5}