phoenix/litellm-mirror
0
0
Fork 1
mirror of https://github.com/BerriAI/litellm.git synced 2025-04-27 03:34:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix timing attack on master_key.

Browse source
This commit is contained in:
David Manouchehri 2023-11-24 12:12:29 -05:00
parent 5165461c51
commit a1a0af824a
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/proxy_server.py
View file

@ -152,10 +152,11 @@ async def user_api_key_auth(request: Request, api_key: str = fastapi.Security(ap
return return
try: try:
route = request.url.path route = request.url.path
if api_key == master_key or api_key == "Bearer " + master_key: is_master_key_valid = secrets.compare_digest(api_key, master_key) or secrets.compare_digest(api_key == "Bearer " + master_key)
if is_master_key_valid:
return return
if (route == "/key/generate" or route == "/key/delete") and not (api_key == master_key or api_key == "Bearer " + master_key): if (route == "/key/generate" or route == "/key/delete") and not is_master_key_valid:
raise Exception(f"If master key is set, only master key can be used to generate new keys") raise Exception(f"If master key is set, only master key can be used to generate new keys")
if prisma_client: if prisma_client: