Skip to content

Conversation

@visadb
Copy link
Contributor

@visadb visadb commented Nov 11, 2025

Description

Enable overriding OpenAI client's Authorization header by removing it if the user provides a custom authorization header with requestOptions: { headers: { Authorization: Basic ... } }

OpenAI client will always send an Authorization: Bearer header since apiKey is a mandatory parameter. Previously, both the OpenAI header and the custom header were sent, breaking at least vLLM set up with basic auth. And it seems like multiple Authorization headers is a breach of the HTTP RFC specs, so there should be no justifiable use case to send more than one.

This is try 2 after #7803 failed to fix the issue. This time I had time to set up a development environment and actually test that the fixed IntelliJ IDEA plugin works against my Basic authenticated vLLM instance.

AI Code Review

  • Team members only: AI review runs automatically when PR is opened or marked ready for review
  • Team members can also trigger a review by commenting @continue-review

Checklist

  • I've read the contributing guide
  • The relevant docs, if any, have been updated or created
  • The relevant tests, if any, have been updated or created

Screen recording or screenshot

This is what headers used to look like before this fix:

...
Authorization: Bearer
Authorization: Basic <my-credentials>
...

And now the Authorization: Bearer one is removed if a custom authorization header is provided.

Tests

I couldn't find an appropriate place to test this customFetch function for its authorization header behaviour. Testing suggestions are welcome!


Summary by cubic

Allows a custom Authorization header to replace the default Bearer header in openai-adapters, fixing duplicate headers and restoring compatibility with Basic-auth setups like vLLM. Prevents sending multiple Authorization headers.

  • Bug Fixes
    • Removes the default Bearer header when requestOptions.headers includes Authorization.
    • Handles Headers, array, and object header formats when stripping the header.

Written for commit 6ad9330. Summary will update automatically on new commits.

Enable overriding OpenAI client's Authorization header by removing it if
the user provides a custom authorization header with `requestOptions: {
headers: { Authorization: Basic ... } }`

OpenAI client will always send an `Authorization: Bearer` header since
`apiKey` is a mandatory parameter. Previously, both the OpenAI header
and the custom header were sent, breaking at least vLLM set up with
basic auth. And it seems like multiple Authorization headers is a breach
of the HTTP RFC specs, so there should be no justifiable use case to
send more than one.
@visadb visadb requested a review from a team as a code owner November 11, 2025 09:43
@visadb visadb requested review from RomneyDa and removed request for a team November 11, 2025 09:43
@dosubot dosubot bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Nov 11, 2025
Copy link
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 1 file

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:S This PR changes 10-29 lines, ignoring generated files.

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

1 participant