From c5801a8925d3ff0c052a0f36837c69a4a24748de Mon Sep 17 00:00:00 2001 From: Rene Fichtmueller Date: Sun, 19 Jul 2026 00:24:36 +0200 Subject: [PATCH] fix: prevent subscription header spoofing --- scripts/client/anthropic-interceptor.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/client/anthropic-interceptor.py b/scripts/client/anthropic-interceptor.py index 22b37b1..81ed06b 100644 --- a/scripts/client/anthropic-interceptor.py +++ b/scripts/client/anthropic-interceptor.py @@ -194,7 +194,16 @@ async def proxy(request: Request, path: str): return JSONResponse(status_code=400, content={"error": "invalid Anthropic request body"}) request_id = f"{target_kind}-companion:{int(time.time() * 1000)}:{uuid.uuid4().hex[:8]}" - blocked = {"connection", "content-length", "host", "transfer-encoding", "x-llm-gateway-key"} + blocked = { + "connection", + "content-length", + "host", + "transfer-encoding", + "x-llm-gateway-key", + "x-llm-gateway-upstream", + "x-llm-interceptor-caller", + "x-llm-request-id", + } headers = {name: value for name, value in request.headers.items() if name.lower() not in blocked} headers.update({ "X-LLM-Gateway-Key": key,