phoenix/litellm-mirror
0
0
Fork 1
mirror of https://github.com/BerriAI/litellm.git synced 2025-04-25 10:44:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix timing attack on master_key.

Browse source
This commit is contained in:
David Manouchehri 2023-11-24 12:12:29 -05:00
parent 5b6f227170
commit ac08e3616c
No known key found for this signature in database
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/proxy_server.py
View file

@ -152,10 +152,11 @@ async def user_api_key_auth(request: Request, api_key: str = fastapi.Security(ap
return
try:
route = request.url.path
if api_key == master_key or api_key == "Bearer " + master_key:
is_master_key_valid = secrets.compare_digest(api_key, master_key) or secrets.compare_digest(api_key == "Bearer " + master_key)
if is_master_key_valid:
return
if (route == "/key/generate" or route == "/key/delete") and not (api_key == master_key or api_key == "Bearer " + master_key):
if (route == "/key/generate" or route == "/key/delete") and not is_master_key_valid:
raise Exception(f"If master key is set, only master key can be used to generate new keys")
if prisma_client: