phoenix/litellm
1
0
Fork 0
forked from phoenix/litellm-mirror
Code Pull requests Activity

Fix timing attack on master_key.

Browse source
This commit is contained in:
David Manouchehri 2023-11-24 12:12:29 -05:00
parent 5b6f227170
commit ac08e3616c
No known key found for this signature in database
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
litellm/proxy/proxy_server.py
View file

@ -152,10 +152,11 @@ async def user_api_key_auth(request: Request, api_key: str = fastapi.Security(ap
return return
try: try:
route = request.url.path route = request.url.path
if api_key == master_key or api_key == "Bearer " + master_key: is_master_key_valid = secrets.compare_digest(api_key, master_key) or secrets.compare_digest(api_key == "Bearer " + master_key)
if is_master_key_valid:
return return
if (route == "/key/generate" or route == "/key/delete") and not (api_key == master_key or api_key == "Bearer " + master_key): if (route == "/key/generate" or route == "/key/delete") and not is_master_key_valid:
raise Exception(f"If master key is set, only master key can be used to generate new keys") raise Exception(f"If master key is set, only master key can be used to generate new keys")
if prisma_client: if prisma_client: