{"record":{"id":"da901c2c60354d44","repo":"BerriAI/litellm","slug":"langfuse-host-must-not-include-credentials","errorCode":null,"errorMessage":"Langfuse host must not include credentials","messagePattern":"Langfuse host must not include credentials","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py","lineNumber":74,"sourceCode":"        # Existing behavior allows host-only Langfuse settings.\n        base_target_url = \"http://\" + base_target_url\n\n    try:\n        base_url: Final = httpx.URL(base_target_url)\n    except Exception as e:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": f\"Invalid Langfuse host: {e}\"},\n        )\n\n    if base_url.scheme not in (\"http\", \"https\") or not base_url.host:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse host\"},\n        )\n\n    if base_url.userinfo:\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Langfuse host must not include credentials\"},\n        )\n\n    return str(base_url)\n\n\ndef _validate_langfuse_proxy_path(endpoint: str) -> str:\n    decoded_endpoint: Final = _decode_to_convergence(endpoint)\n    if any(ord(char) < 32 for char in decoded_endpoint):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse endpoint path\"},\n        )\n    if \"\\\\\" in decoded_endpoint or decoded_endpoint.startswith(\"//\"):\n        raise HTTPException(\n            status_code=status.HTTP_400_BAD_REQUEST,\n            detail={\"error\": \"Invalid Langfuse endpoint path\"},","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py#L56-L92","documentation":"Credential-in-URL guard: the Langfuse host URL carries userinfo (user:password before the @), which would be forwarded or logged and is never legitimate for a Langfuse endpoint. The proxy refuses the configuration to avoid leaking embedded credentials.","triggerScenarios":"Thrown at litellm/proxy/vertex_ai_endpoints/langfuse_endpoints.py:74 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Remove any user:password credentials from the Langfuse host URL; pass credentials separately."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}