[Frontend] Simplify AuthenticationMiddleware path extraction#43426
Merged
Conversation
Use scope["path"] directly instead of reconstructing a full URL via URL(scope=scope).path. The scope path is already available and avoids an unnecessary round-trip through URL parsing. Fixes GHSA-94f4-hr76-p5j6 Signed-off-by: Russell Bryant <rbryant@redhat.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
russellb
requested review from
DarkLight1337,
aarnphm and
chaunceyjiang
as code owners
![gemini-code-assist[bot]](data:image/webp;base64,UklGRpAGAABXRUJQVlA4WAoAAAA4AAAAOwAAOwAASUNDUOABAAAAAAHgbGNtcwQgAABtbnRyUkdCIFhZWiAH4gADABQACQAOAB1hY3NwTVNGVAAAAABzYXdzY3RybAAAAAAAAAAAAAAAAAAA9tYAAQAAAADTLWhhbmR56b9WWj4BtoMjhVVG90+qAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApkZXNjAAAA/AAAACRjcHJ0AAABIAAAACJ3dHB0AAABRAAAABRjaGFkAAABWAAAACxyWFlaAAABhAAAABRnWFlaAAABmAAAABRiWFlaAAABrAAAABRyVFJDAAABwAAAACBnVFJDAAABwAAAACBiVFJDAAABwAAAACBtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAgAAAAcAHMAUgBHAEJtbHVjAAAAAAAAAAEAAAAMZW5VUwAAAAYAAAAcAEMAQwAwAABYWVogAAAAAAAA9tYAAQAAAADTLXNmMzIAAAAAAAEMPwAABd3///MmAAAHkAAA/ZL///uh///9ogAAA9wAAMBxWFlaIAAAAAAAAG+gAAA48gAAA49YWVogAAAAAAAAYpYAALeJAAAY2lhZWiAAAAAAAAAkoAAAD4UAALbEcGFyYQAAAAAAAwAAAAJmaQAA8qcAAA1ZAAAT0AAACltBTFBIggEAAAGQg23bsTdPbNvWF9vJ5Nm2U9u2Nmtzu3WybVuTbX3HM3x6v+fp0TkiJgD+T93COAUkcJIKOJXXcho1g9PGHZwu3mbk/xfD+HQhDvE5iXiaTTwiYgKXtYp1TPy/Kr4F8liDqmtZxP5Wk5MZWJ5Czcs29GaizuXkiv7qwUpiUS9Q9/tkUuHP0eBLiVDUczT8KolM4QsU+K6chuW0PyhUXmRNIOIoCj+fYJbH4p9o4u81vmYELnmHJn9eHS7Is3G/jBQPtPnqcguQyobXn/6NZP+e3zi6IinQXREuFdXP3vMICT/bN6+xWIpUaMZPvEXjwbRkEJu//bdZf/eVWoD4qG3m7EoAk7Oui7tXDObbrhK1wRFIVr8X8aUOqCa/NPYhF+hKr4x8yAbKSe/0fckF2hWyrhqgvlTPWiBvc0nrtj09SPmjkQMcN6htA5YhPxQ/w3nAZsVWYJqiSOUCFxAvAdt+xDF8gmWM5gNX7wPjLbs5jZ3NqbKeU1IRp0CJk3sEp386VlA4ID4CAABwDgCdASo8ADwAPmkoj0WkIqEb+q0AQAaEtQBk4PYfj/SeId498AVTDxANwBuWfUAbyRXa/26RA7Kw43eDGAM230VvnfQl/VVhWEHkfrPcut8/t8CIB02JifGet5cKqv9GlYMn/KO8MCTKyfcSkXbUD94UranneoejvEAAAP79wI3eaNYIMg0pzCX/V12C6vGjMszKiS9q7/UGdsM/wWOncPsfL0sl7h0G5SI5FJFC3UsuYhvRQJQxCSwly3+UajgW2KOc35I8f7ofA40rln0wBeSlftB8uuN4EBxC3J0Ph79Xx5PArw32CBZqxKE4FE/6s4eIYbDERSXFZ1PSgBRuqym9v0uuVpth/yNU9B3TDdvCaiVi9QN8vwq+UCZCKMdEgsLiTEdojMJCNK11JEHGiPaae2He8L2VBRGh6t5tTmX/UQ9VWwVFVHXBzYDwnmU1YFqjfuzN7tSb68duszC+XxXh2NY86d0VVkN/0RcT+J9A7PZtvArEa0rINtseTz1VvtIRhD0i/+HpoU+BD0C7tVJT1wkU62/7rvRPeh7Hm607YifJm/xw9W/yDn7n0gxFm/0+PZLexIP6yRUU1cCjccu3xZpl2COcAj9X1MnpEXP1mjftPDREUBYJazeG/9AYSB//F/Dn9YHAl6a90Mv247DuUaWv0qKmjtzVj0HDEgGPQQsf+gSlrY597dHvDeewQXAs/p4WdkD3fKjy6XmiB8tfwT2nDGsm2PlEkvyeLT/QRM3LwFwBnvQAAAAARVhJRroAAABFeGlmAABJSSoACAAAAAYAEgEDAAEAAAABAAAAGgEFAAEAAABWAAAAGwEFAAEAAABeAAAAKAEDAAEAAAACAAAAEwIDAAEAAAABAAAAaYcEAAEAAABmAAAAAAAAAEgAAAABAAAASAAAAAEAAAAGAACQBwAEAAAAMDIxMAGRBwAEAAAAAQIDAACgBwAEAAAAMDEwMAGgAwABAAAA//8AAAKgBAABAAAAPAAAAAOgBAABAAAAPAAAAAAAAAA=){kind=small}
Contributor
Code Review
This pull request simplifies path extraction in vllm/entrypoints/openai/server_utils.py by replacing the Starlette URL object with direct access to scope["path"]. Feedback indicates that this change fails to address a potential authentication bypass vulnerability; because scope["path"] is not normalized, an attacker could use multiple leading slashes to circumvent prefix-based security checks. A code suggestion was provided to normalize the path before performing the prefix check.
DarkLight1337
approved these changes
May 22, 2026
x41j
approved these changes
May 22, 2026
mgoin
approved these changes
May 22, 2026
tlrmchlsmth
approved these changes
May 22, 2026
h1t35h
pushed a commit
to h1t35h/vllm
that referenced
this pull request
May 26, 2026
…oject#43426) Signed-off-by: Russell Bryant <rbryant@redhat.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Use scope["path"] directly instead of reconstructing a full URL via
URL(scope=scope).path. The scope path is already available and avoids
an unnecessary round-trip through URL parsing.
Fixes GHSA-94f4-hr76-p5j6
Signed-off-by: Russell Bryant rbryant@redhat.com
Co-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com