Repository navigation
Send no Authorization header to the LLM when api_key is unset (#420) - #428
Merged
Merged
Conversation
A header set by the page replaces the browser's saved basic-auth credentials, so a deployment behind nginx auth_basic that proxies /api/llm/ got 401 on every request. The agent and the transcriber now send Authorization only when api_key is a non-blank string.
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #420.
The agent and the transcriber sent
Authorization: Bearer …on every LLM request, even with no key (the transcriber sentBearer EMPTY). A header set by the page replaces the browser's saved basic-auth credentials, so a deployment behind nginxauth_basicthat proxies/api/llm/got 401 on every request (boettiger-lab/bosl-high-seas#85).Both now send the header only when
api_keyis a non-blank string. The rule is in a newapp/llm-auth.js, used byagent.jsandtranscriber.js. The deployment guide says to leaveapi_keyout when a same-origin proxy injects the real key.Apps that set a key are unchanged. The one visible change is that the transcriber no longer sends
Bearer EMPTYwhen no key is set.Tests:
test/llm-auth.test.js. The transcriber test that asserted theEMPTYfallback now asserts that no header is sent.