rene.fichtmueller/llm-gateway
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: prevent subscription header spoofing
All checks were successful
changelog-draft / changelog-draft (push) Successful in 32s
Details

Browse Source
This commit is contained in:
Rene Fichtmueller 2026-07-19 00:24:36 +02:00
parent 453d580f69
commit c5801a8925
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/client/anthropic-interceptor.py
View File

@ -194,7 +194,16 @@ async def proxy(request: Request, path: str):
return JSONResponse(status_code=400, content={"error": "invalid Anthropic request body"}) return JSONResponse(status_code=400, content={"error": "invalid Anthropic request body"})
request_id = f"{target_kind}-companion:{int(time.time() * 1000)}:{uuid.uuid4().hex[:8]}" request_id = f"{target_kind}-companion:{int(time.time() * 1000)}:{uuid.uuid4().hex[:8]}"
blocked = {"connection", "content-length", "host", "transfer-encoding", "x-llm-gateway-key"} blocked = {
"connection",
"content-length",
"host",
"transfer-encoding",
"x-llm-gateway-key",
"x-llm-gateway-upstream",
"x-llm-interceptor-caller",
"x-llm-request-id",
}
headers = {name: value for name, value in request.headers.items() if name.lower() not in blocked} headers = {name: value for name, value in request.headers.items() if name.lower() not in blocked}
headers.update({ headers.update({
"X-LLM-Gateway-Key": key, "X-LLM-Gateway-Key": key,