Linear ticket

Resolves LIT-2966

Bug: Bedrock KB pass-through (POST /bedrock/knowledgebases/…/retrieve) dropped botocore SigV4 headers (HeadersDict was treated as non-dict → {}), could forward Bearer alongside AWS4 auth, and re-json=’d a body hooks had mutated so it no longer matched the signed payload → 403 (“missing equal-sign” in Authorization) or hangs.

Fix: Coerce Mapping headers to dict; when forward_headers=True, strip request headers that case-insensitively collide with signed/custom headers; stash prepped.body on request.state and send it as content=… in pass_through_request so the wire matches SigV4.

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have Added testing in the tests/test_litellm/ directory, Adding at least 1 test is a hard requirement - see details
• My PR passes all unit tests on make test-unit (maintainer / author to confirm CI)
• My PR's scope is as isolated as possible, it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

CI (LiteLLM team)

CI status guideline:

• 50-55 passing tests: main is stable with minor issues.
• 45-49 passing tests: acceptable but needs attention
• <= 40 passing tests: unstable; be careful with your merges and assess the risk.

• Branch creation CI run
  Link:

• CI run for the last commit
  Link:

• Merge / cherry-pick CI run
  Links:

Screenshots / Proof of Fix

Problem

• Bedrock KB retrieve via proxy (POST /bedrock/knowledgebases/{id}/retrieve) could drop botocore SigV4 headers because prepped.headers is a HeadersDict (Mapping, not dict), so pass-through coerced “custom headers” to {} and only the client’s Authorization: Bearer … reached AWS → malformed auth / hangs depending on transport.
• With forward_headers=True, request authorization (lowercase) could coexist with signed Authorization, duplicating auth semantics.
• After hooks inject fields into the parsed JSON dict, re-encoding with json= can diverge from the bytes SigV4 signed (Content-Length / body mismatch).

After (runtime)

• Proxy returns an AWS response quickly (no client hang). Example against a misconfigured KB: HTTP 400 with AWS body
  {"message":"Invalid input or configuration provided. ..."} — same class of response as a direct signed POST to bedrock-agent-runtime, proving SigV4 and body reach AWS.
• Debug log shows outbound URL https://bedrock-agent-runtime.<region>.amazonaws.com/knowledgebases/.../retrieve, Authorization: AWS4-HMAC-SHA256…, and Content-Length matching the signed payload.

Important: For the KB used in the capture below (TIXO72HGCJ in eu-north-1), HTTP 400 from the fixed proxy is expected and correct. It means the request reached bedrock-agent-runtime with valid SigV4 and AWS returned a ValidationException-style message about KB input/configuration—not the previous 403 “missing equal-sign” in Authorization from malformed client auth reaching AWS.

Live requests (same curl; RC vs fix)

Use litellm-proxy venv, source .env, and config litellm_config/config_venv_1_83_3_minimal.yaml. Knowledge base path: /bedrock/knowledgebases/TIXO72HGCJ/retrieve.

Shared request

POST /bedrock/knowledgebases/TIXO72HGCJ/retrieve
Authorization: Bearer sk-123
Content-Type: application/json

{"retrievalQuery":{"text":"test"}}

curl (add -i for response headers)

curl -sS -i --max-time 35 -X POST 'http://127.0.0.1:<PORT>/bedrock/knowledgebases/TIXO72HGCJ/retrieve' \
  -H 'Authorization: Bearer sk-123' \
  -H 'Content-Type: application/json' \
  -d '{"retrievalQuery":{"text":"test"}}'

Before — v1.84.0-rc.1 (no fix), proxy e.g. port 4036

HTTP/1.1 403 Forbidden
date: Sat, 09 May 2026 08:53:17 GMT
server: uvicorn
x-litellm-call-id: 6581523b-3a65-45ea-8bf5-02d78792a165
x-litellm-model-api-base: https://bedrock-agent-runtime.eu-north-1.amazonaws.com/knowledgebases/TIXO72HGCJ/retrieve
x-litellm-key-spend: 0.0
content-length: 246
content-type: application/json

{"error":{"message":"{\"message\":\"Invalid key=value pair (missing equal-sign) in Authorization header (hashed with SHA-256 and encoded with Base64): 'Gp8sbH4GYN+oHjYn0EUrSOuivOCwhx+sCUf3IkSFTi0='.\"}","type":"None","param":"None","code":"403"}}

After — branch litellm_bedrock_kb_passthrough_sigv4_fix, proxy e.g. port 4035

HTTP 400 is expected here: AWS accepted the transport/auth and responded with a KB validation/configuration error for this resource.

HTTP/1.1 400 Bad Request
date: Sat, 09 May 2026 08:53:35 GMT
server: uvicorn
x-litellm-call-id: a6c44259-af96-48a8-8554-a46c22f2035b
x-litellm-model-api-base: https://bedrock-agent-runtime.eu-north-1.amazonaws.com/knowledgebases/TIXO72HGCJ/retrieve
x-litellm-key-spend: 0.0
content-length: 201
content-type: application/json

{"error":{"message":"{\"message\":\"Invalid input or configuration provided. Check the input and Knowledge Base configuration and try your request again.\"}","type":"None","param":"None","code":"400"}}

Tests

• test_forward_headers_custom_wins_case_insensitive_over_request_authorization — custom/signed headers win over forwarded request headers when names differ only by case.
• test_create_pass_through_route_custom_body_url_target — non-dict custom_headers (e.g. Starlette Headers) is coerced to a plain dict so values are not dropped.

Type

🐛 Bug Fix

Changes

• create_pass_through_route: Treat custom_headers as Optional[Mapping[str, Any]] and normalize with dict(...) when it is a Mapping, so botocore HeadersDict from SigV4-prepared requests is not replaced by {}.
• BasePassthroughUtils.forward_headers_from_request: When forward_headers=True, remove incoming request header names that collide case-insensitively with keys already in the custom/signed header dict before merging, so client Bearer does not sit beside Authorization: AWS4-....
• Bedrock KB pass-through (bedrock_proxy_route): Store prepped.body on request.state under LITELLM_PASS_THROUGH_RAW_BODY_STATE_KEY (see litellm/types/passthrough_endpoints/pass_through_endpoints.py).
• pass_through_request: If that state key is set, send the exact bytes with content=... (streaming and non-streaming paths); otherwise keep the existing JSON path. Clear the raw-body state key in create_pass_through_route’s finally alongside the existing custom-body key.