Skip to content

fix(api-proxy): strip all Gemini auth query param variants to prevent API_KEY_INVALID #2182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 3 commits into from
Apr 24, 2026
Merged

fix(api-proxy): strip all Gemini auth query param variants to prevent API_KEY_INVALID #2182

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
02297d4
Initial plan
Copilot Apr 24, 2026
314ecfe
fix: strip apiKey/api_key Gemini params and add startup logging
Copilot Apr 24, 2026
06dfc83
fix: update stale comments and add missing 6th test case
Copilot Apr 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
fix: update stale comments and add missing 6th test case 
Agent-Logs-Url: https://github.com/github/gh-aw-firewall/sessions/46aa116c-47a9-4f66-8e20-13cb6f683aab

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
  • Loading branch information
@lpcox
Copilot and lpcox authored Apr 24, 2026
commit 06dfc8356d494fc0d742efbf8754bf28aa39cd16
4 changes: 2 additions & 2 deletions containers/api-proxy/server.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1070,7 +1070,7 @@ if (require.main === module) {
const contentLength = parseInt(req.headers['content-length'], 10) || 0;
if (checkRateLimit(req, res, 'gemini', contentLength)) return;

// Strip any ?key= query parameter — the @google/genai SDK may append it to the URL.
// Strip any auth query params (?key=, ?apiKey=, ?api_key=) — the SDK may append them.
// The proxy injects the real key via x-goog-api-key header instead.
req.url = stripGeminiKeyParam(req.url);

Expand All @@ -1080,7 +1080,7 @@ if (require.main === module) {
});

geminiServer.on('upgrade', (req, socket, head) => {
// Strip any ?key= query parameter — the @google/genai SDK may append it to the URL.
// Strip any auth query params (?key=, ?apiKey=, ?api_key=) — the SDK may append them.
req.url = stripGeminiKeyParam(req.url);
proxyWebSocket(req, socket, head, GEMINI_API_TARGET, {
'x-goog-api-key': GEMINI_API_KEY,
Expand Down
5 changes: 5 additions & 0 deletions containers/api-proxy/server.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,6 +564,11 @@ describe('stripGeminiKeyParam', () => {
expect(stripGeminiKeyParam('/v1/models/gemini-pro:generateContent?key=foo&apiKey=bar&api_key=baz&alt=json'))
.toBe('/v1/models/gemini-pro:generateContent?alt=json');
});

it('should handle path with only api_key= param, leaving no trailing ?', () => {
const result = stripGeminiKeyParam('/v1/generateContent?api_key=abc');
expect(result).toBe('/v1/generateContent');
});
Comment on lines +543 to +571
});

// ── Helpers for proxyWebSocket tests ──────────────────────────────────────────
Expand Down
Loading