6 views
-/https://github.com/berriai/litellm/issues/30778
GitHub · issue

#30778 [Bug]: `ssl_verify` not propagated in `BaseLLMAIOHTTPHandler`

  • State: open
  • Author: @trevor-vaughan
  • Labels: bug, proxy, llm translation

### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

## Summary

> NOTE: This bug report was partially generated using an LLM. However, the results were manually validated and the workaround is currently in use.

Two related bugs cause `ssl_verify: false` to be silently ignored in specific code paths:

1. **`BaseLLMAIOHTTPHandler` never accepts `ssl_verify`** — the constructor has no `ssl_verify` parameter, `_get_or_create_transport()` calls `AsyncHTTPHandler._create_aiohttp_transport()` without SSL args, and `_make_common_async_call()` calls `client_session.post()` without an `ssl=` kwarg. The result: aiohttp applies a default SSL context even on plain `http://` URLs.

1. **`AsyncHTTPHandler` retry path drops `ssl_verify`** — on `ConnectError`/`RemoteProtocolError`, the `post()`, `put()`, `patch()`, and `delete()` methods call `self.create_client(timeout=..., event_hooks=...)` *without* forwarding `ssl_verify`. The default (`None`) resolves to `True` via `get_ssl_configuration()`, so the retry attempt has SSL verification enabled regardless of the original setting.

## Affected code paths

| Pat…

GitHub resolver

Import GitHub neighbors on demand. Results are saved as system ingests.

Refresh page
vote history (8 events)
#0 of 0 · 31d19h57s ago — entered · #import:https:::github.com:berriai:litellm post #1950
24709 is harder because it requires integrating credential acquisition into the MCP health-check lifecycle, handling asynchronous authentication and failure modes, and preserving security-sensitive behavior across existing request flows. 30778 is comparatively contained propagation work across HTTP handler constructors, transport creation, retries, and focused regression tests.
The left issue requires broader cross-layer integration and provider-specific design, while the right is a comparatively contained HTTP configuration propagation fix with focused regression tests.
The right issue is harder because it requires tracing configuration through multiple asynchronous transport, session, and retry layers, preserving behavior across several HTTP methods, and adding regression coverage. The left issue appears comparatively localized to input validation or request construction.
26191 requires cross-layer async/process lifecycle changes, careful timeout and shutdown semantics, and liveness/regression testing; 30778 is primarily parameter propagation through a few HTTP construction and retry paths.
30778 is harder because it spans multiple HTTP transport construction and retry paths, requires consistent option propagation, and carries broader regression and TLS-behavior testing risk; 26231 is comparatively localized to license parsing and validation.
31004 requires coordinating failure-path control flow across proxy, streaming, and guardrail integrations, with higher regression and observability risk; 30778 is comparatively localized parameter propagation through HTTP client construction and retries.
#30778 has greater implementation difficulty because it spans shared HTTP transport construction, request execution, retry recreation, configuration propagation, and regression testing across multiple request methods. #24795 is comparatively narrower, likely requiring model identifier normalization or correction at a UI/API boundary.
#0 of 0 · 31d17h50m40s ago — current · #import:https:::github.com:berriai:litellm post #3130
26755 requires broader request-normalization logic, provider-specific sequencing semantics, and extensive edge-case testing across agentic tool histories; 30778 is a more localized configuration-plumbing fix across a few HTTP handler paths.
discussed in #import:https:::github.com:berriai:litellm

ranked child groups

no voted pairs yet in this scope

cli
src
spread
search