fix(proxy)!: apply request-parameter checks consistently across body, path and form inputs

[yuneng-berri]

TLDR

Problem this solves:

• Request-parameter checks covered the body only
• Path-supplied deployment names skipped the destination check
• Bracket-notation form metadata skipped the parameter check
• Connection tests could borrow a configured model's credentials

How it solves it:

• One destination check shared by body and path inputs
• Form metadata rebuilt with the helper endpoints already use
• Configured credentials stay with the endpoint they belong to
• Three admin opt-outs preserved for legitimate overrides

Relevant issues

Linear ticket

Resolves LIT-5261

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review (Greptile reviews automatically once the PR is opened; only comment @greptileai to re-request a review after pushing changes)

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Verified against a live proxy on a dedicated port, with a local listener standing in for a
caller-chosen destination and a wildcard deployment so routing was not what stopped the request

Each of the three changes was exercised before and after, with the adjacent legitimate flows run
in the same pass: an ordinary chat completion, a normal deployment-path request, a plain file
upload, benign bracket metadata, a connection test that names a configured model, and a
connection test that supplies its own complete connection. All of those behave the same before
and after

Full request and response detail is available on request rather than published here, since the
before runs double as a working reproduction

Captured at 59173c3 (after) against origin/litellm_internal_staging at 8ec562f (before)

Type

🐛 Bug Fix

Changes

reject_url_valued_destination(field, value) is split out of
_reject_url_valued_destinations so a single field can be checked on its own. The body loop
delegates to it, and a deployment name resolved from the request path now runs through it too,
against the same provider_url_destination_allowed_hosts allowlist. Only a caller-supplied path
value is checked, so an operator who pins a URL-valued model through completion_model or the
--model CLI argument is unaffected

is_request_body_safe rebuilds bracket-notation metadata with
extract_nested_form_metadata, the same helper the endpoints already use to reconstruct that
dict. Reusing it keeps the two from drifting apart, and the reconstruction is inspected at the
same single level of nesting the dict form already gets, so the two encodings agree

/health/test_connection no longer merges a configured deployment's credentials underneath a
request that sets its own connection fields: those credentials belong to the endpoint the
configuration names. Anything the request leaves unset still comes from the configuration, so
naming a configured model and testing it as configured is unchanged, and the Add Model wizard,
which sends a complete connection, works whether or not its model name matches an existing
deployment. general_settings.allow_client_side_credentials, the existing proxy-wide opt-in for
callers supplying their own connection parameters, restores the previous merge behaviour

Three breaking changes, each with an existing opt-out:

• A URL-valued deployment name in the request path is refused; add the host to
  provider_url_destination_allowed_hosts
• A multipart litellm_metadata[...] field carrying a restricted parameter is refused; set
  general_settings.allow_client_side_credentials or the deployment's
  configurable_clientside_auth_params
• A connection test that sets its own connection fields no longer inherits the configured
  deployment's credentials; supply the credential alongside the endpoint, or set
  general_settings.allow_client_side_credentials

Final Attestation

• The tests check the right things, including the edge cases, and regressions in the respective real-world customer use-cases are not possible after this PR

---

Note

High Risk
Touches proxy auth, SSRF boundaries, and credential merging on admin health endpoints; behavior changes are intentional breaking fixes with opt-outs, but misconfiguration could block legitimate BYOK or deployment-path flows.

Overview
Closes gaps where proxy security checks only applied to JSON bodies, letting path segments, multipart form metadata, and health-test merges bypass the same rules.

URL-valued destinations — reject_url_valued_destination is extracted so one check runs on JSON model/file_id and on path-derived deployment names (completions and Azure image routes). Non-string values are skipped.

Multipart metadata — is_request_body_safe now rebuilds metadata[...] / litellm_metadata[...] bracket keys via extract_nested_form_metadata and runs the same banned-param logic as nested dicts.

Connection tests — /health/test_connection merges router config through _config_base_for_health_check: if the request sets any _BANNED_REQUEST_BODY_PARAMS connection field, configured credentials (including litellm_credential_name) are stripped from the base unless general_settings.allow_client_side_credentials is enabled.

Each tightening has documented opt-outs (provider_url_destination_allowed_hosts, allow_client_side_credentials, deployment-level configurable auth params).

^{Reviewed by Cursor Bugbot for commit 298fb8c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Greptile Summary

This PR applies consistent request-parameter validation to body, path, multipart metadata, and configured-model connection-test inputs.

• Validates URL-valued path deployment names against the configured destination allowlist.
• Reconstructs and validates bracket-notation multipart metadata.
• Rejects selected request overrides when testing configured deployments.

Confidence Score: 4/5

The PR is not yet safe to merge because configured-model connection tests can still run with a caller-supplied API key.

The request-over-configuration merge preserves api_key, the new rejection does not cover that field, and the resulting parameters are passed to the health check, so success can reflect the caller's credential rather than the configured deployment.

Files Needing Attention: litellm/proxy/health_endpoints/_health_endpoints.py; litellm/proxy/auth/auth_utils.py

Important Files Changed

Filename	Overview
litellm/proxy/health_endpoints/_health_endpoints.py	Adds configured-model override rejection, but the previously reported caller-supplied api_key override remains reachable.
litellm/proxy/auth/auth_utils.py	Extends request safety checks to reconstructed bracket-notation metadata.
litellm/proxy/litellm_pre_call_utils.py	Extracts single-field URL destination validation for reuse by path-based inputs.
litellm/proxy/common_request_processing.py	Validates caller-supplied path models before applying server-configured model precedence.
litellm/proxy/image_endpoints/endpoints.py	Applies the shared destination check to the image-generation deployment path.

_{Reviews (2): Last reviewed commit: "fix(health)!: let configured deployment ..." | Re-trigger Greptile}

[yuneng-berri]

@greptile review again

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[yucheng-berri]

bugbot run

[yuneng-berri]

bugbot run

[yucheng-berri]

@grepileai review latest head

[yucheng-berri]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 298fb8c. Configure here.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_maint_batch_2026_07 (298fb8c) with litellm_internal_staging (aa1180c)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (298fb8c) during the generation of this report, so aa1180c was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩