fix(security): redact invalid Azure authentication credentials

src/azure.ts

@@ -1,6 +1,6 @@
 import type { RequestInit, RequestInfo, Response } from './internal/builtin-types';
 import type { NullableHeaders } from './internal/headers';
-import { buildHeaders } from './internal/headers';
+import { buildAzureAuthenticationHeaders, buildHeaders } from './internal/headers';
 import * as Errors from './error';
 import type { FinalRequestOptions } from './internal/request-options';
 import { isObj, readEnv } from './internal/utils';
@@ -126,6 +126,7 @@ export class AzureOpenAI extends OpenAI {
       throw new Errors.OpenAIError('baseURL and endpoint are mutually exclusive');
     }
 
+    protectAzureAmbientHeaders(opts);
     super({
       apiKey: azureADTokenProvider ?? apiKey,
       baseURL,
@@ -183,7 +184,9 @@ export class AzureOpenAI extends OpenAI {
     controller: AbortController,
     schemes?: { bearerAuth?: boolean; adminAPIKeyAuth?: boolean },
   ): Promise<Response> {
-    if (new Headers(init.headers).has('api-key')) {
+    const headers = buildHeaders([buildAzureAuthenticationHeaders(), init.headers]).values;
+    init.headers = headers;
+    if (headers.has('api-key')) {
       init.redirect = 'manual';
     }
 
@@ -196,9 +199,33 @@ export class AzureOpenAI extends OpenAI {
   ): Promise<NullableHeaders | undefined> {
     const security = schemes ?? { bearerAuth: true, adminAPIKeyAuth: true };
     if (security.bearerAuth && typeof this._options.apiKey === 'string') {
-      return buildHeaders([{ 'api-key': this.apiKey }]);
+      return buildAzureAuthenticationHeaders([['api-key', this.apiKey]]);
     }
-    return super.authHeaders(opts, security);
+
+    return buildAzureAuthenticationHeaders(
+      security.bearerAuth ? await this.bearerAuth(opts) : undefined,
+      security.adminAPIKeyAuth ? await this.adminAPIKeyAuth(opts) : undefined,
+    );
+  }
+
+  protected override async bearerAuth(_opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
+    if (this.apiKey === null) {
+      return undefined;
+    }
+    return buildAzureAuthenticationHeaders([['Authorization', `Bearer ${this.apiKey}`]]);
+  }
+
+  protected override async adminAPIKeyAuth(_opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
+    if (this.adminAPIKey === null || this.adminAPIKey === undefined) {
+      return undefined;
+    }
+    return buildAzureAuthenticationHeaders([['Authorization', `Bearer ${this.adminAPIKey}`]]);
+  }
+}
+
+function protectAzureAmbientHeaders(options: Pick<ClientOptions, 'defaultHeaders'>): void {
+  if (readEnv('OPENAI_CUSTOM_HEADERS')) {
+    options.defaultHeaders = buildAzureAuthenticationHeaders(options.defaultHeaders);
   }
 }
 

src/beta/realtime/websocket.ts

@@ -1,4 +1,5 @@
 import type { AzureOpenAI } from '../../index';
+import { assertAzureCredentialHeaderValue } from '../../internal/azure';
 import { assertBedrockWebSocketOrigin } from '../../internal/bedrock';
 import { OpenAI } from '../../index';
 import { OpenAIError } from '../../error';
@@ -119,6 +120,7 @@ function createAzureWebSocket(
     throw new Error('Azure OpenAI Realtime requires an API key');
   }
 
+  assertAzureCredentialHeaderValue(apiKey);
   redactAzureCredentials(url, isBearerToken);
   const socketURL = new URL(url);
   socketURL.searchParams.delete('api-key');

src/beta/realtime/ws.ts

@@ -1,4 +1,5 @@
 import * as WS from 'ws';
+import { safeAzureWebSocketHeaders } from '../../internal/azure';
 import { assertBedrockWebSocketOrigin } from '../../internal/bedrock';
 import { protectWebSocketOptionsFromCredentialRedirects } from '../../internal/ws';
 import type { AzureOpenAI } from '../../index';
@@ -77,7 +78,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
       this.url,
       protectWebSocketOptionsFromCredentialRedirects({
         ...props.options,
-        headers,
+        headers: isAzure(client) ? safeAzureWebSocketHeaders(headers) : headers,
       }),
     );
 

src/internal/azure.ts

@@ -0,0 +1,56 @@
+/** Rejects invalid HTTP-field bytes without exposing a private Azure credential. */
+export function assertAzureCredentialHeaderValue(value: string): void {
+  for (const character of value) {
+    const code = character.codePointAt(0) ?? 0;
+    if ((code < 0x20 && code !== 0x09) || code === 0x7f || code > 0xff) {
+      throw new TypeError('Azure OpenAI credential contains an invalid HTTP header value.');
+    }
+  }
+}
+
+/** Identifies the two credential-bearing Azure HTTP header fields. */
+export function isAzureAuthenticationHeader(name: string): boolean {
+  const normalized = name.toLowerCase();
+  return normalized === 'authorization' || normalized === 'api-key';
+}
+
+/**
+ * Collapses case-insensitive WebSocket credential overrides before validating
+ * only the effective values. Callers supply SDK-created plain header records.
+ */
+export function safeAzureWebSocketHeaders<Headers extends Record<string, unknown>>(
+  headers: Headers,
+): Headers {
+  const safeHeaders = new Map<string, unknown>();
+  const authenticationNames = new Map<string, string>();
+
+  for (const [name, value] of Object.entries(headers)) {
+    if (!isAzureAuthenticationHeader(name)) {
+      safeHeaders.set(name, value);
+      continue;
+    }
+
+    const normalized = name.toLowerCase();
+    const previousName = authenticationNames.get(normalized);
+    if (previousName !== undefined) {
+      safeHeaders.delete(previousName);
+      authenticationNames.delete(normalized);
+    }
+    if (value === null || value === undefined) {
+      continue;
+    }
+    safeHeaders.set(name, value);
+    authenticationNames.set(normalized, name);
+  }
+
+  for (const name of authenticationNames.values()) {
+    const value = safeHeaders.get(name);
+    const values = Array.isArray(value) ? value : [value];
+    for (const entry of values) {
+      if (typeof entry === 'string') {
+        assertAzureCredentialHeaderValue(entry);
+      }
+    }
+  }
+  return Object.fromEntries(safeHeaders) as Headers;
+}

src/internal/headers.ts

@@ -1,3 +1,4 @@
+import { assertAzureCredentialHeaderValue, isAzureAuthenticationHeader } from './azure';
 import { isReadonlyArray } from './utils/values';
 
 type HeaderValue = string | undefined | null;
@@ -26,11 +27,46 @@ export type NullableHeaders = {
   nulls: Set<string>;
 };
 
+type AzureAuthenticationValues = ReadonlyArray<HeadersLike>;
+
+// Object-identity branding cannot be forged by caller-provided header records.
+const azureAuthenticationHeaders = new WeakMap<NullableHeaders, AzureAuthenticationValues>();
+
+/**
+ * Creates an authenticated Azure header carrier without first appending a raw
+ * credential to native Headers, where rejected values appear in diagnostics.
+ */
+export const buildAzureAuthenticationHeaders = (...headers: AzureAuthenticationValues): NullableHeaders => {
+  const carrier: NullableHeaders = {
+    [brand_privateNullableHeaders]: true,
+    values: new Headers(),
+    nulls: new Set<string>(),
+  };
+  azureAuthenticationHeaders.set(carrier, headers);
+  return carrier;
+};
+
 function* iterateHeaders(headers: HeadersLike): IterableIterator<readonly [string, string | null]> {
   if (!headers) return;
 
   if (brand_privateNullableHeaders in headers) {
     const { values, nulls } = headers;
+    const visibleNames = new Set([...values.keys(), ...nulls].map((name) => name.toLowerCase()));
+    const azureHeaders = azureAuthenticationHeaders.get(headers);
+    if (azureHeaders !== undefined) {
+      for (const layer of azureHeaders) {
+        const seen = new Set<string>();
+        for (const [name, value] of iterateHeaders(layer)) {
+          const normalized = name.toLowerCase();
+          if (visibleNames.has(normalized)) continue;
+          if (!seen.has(normalized)) {
+            seen.add(normalized);
+            yield [name, null];
+          }
+          yield [name, value];
+        }
+      }
+    }
     yield* values.entries();
     for (const name of nulls) {
       yield [name, null];
@@ -67,29 +103,72 @@ function* iterateHeaders(headers: HeadersLike): IterableIterator<readonly [strin
   }
 }
 
+/** Validates only the final authentication values without native construction. */
+export const assertAzureAuthenticationHeaders = (headers: HeadersLike): void => {
+  for (const [name, value] of iterateHeaders(headers)) {
+    if (value !== null && isAzureAuthenticationHeader(name)) {
+      assertAzureCredentialHeaderValue(value);
+    }
+  }
+};
+
 export const buildHeaders = (newHeaders: HeadersLike[]): NullableHeaders => {
   const targetHeaders = new Headers();
   const nullHeaders = new Set<string>();
+  const protectsAzureCredentials = newHeaders.some(
+    (headers) =>
+      typeof headers === 'object' &&
+      headers !== null &&
+      azureAuthenticationHeaders.has(headers as NullableHeaders),
+  );
+  const pendingAuthenticationHeaders = new Map<string, string[]>();
+
   for (const headers of newHeaders) {
     const seenHeaders = new Set<string>();
     for (const [name, value] of iterateHeaders(headers)) {
       if (!httpTokenHeaderName.test(name)) {
         throw new TypeError(`Header name must be a valid HTTP token ["${name}"]`);
       }
       const lowerName = name.toLowerCase();
+      const deferAuthenticationHeader = protectsAzureCredentials && isAzureAuthenticationHeader(lowerName);
       if (!seenHeaders.has(lowerName)) {
         targetHeaders.delete(lowerName);
+        if (deferAuthenticationHeader) {
+          pendingAuthenticationHeaders.delete(lowerName);
+        }
         seenHeaders.add(lowerName);
       }
       if (value === null) {
         targetHeaders.delete(lowerName);
+        if (deferAuthenticationHeader) {
+          pendingAuthenticationHeaders.delete(lowerName);
+        }
         nullHeaders.add(lowerName);
       } else {
-        targetHeaders.append(lowerName, value);
+        if (deferAuthenticationHeader) {
+          const pending = pendingAuthenticationHeaders.get(lowerName);
+          if (pending) {
+            pending.push(value);
+          } else {
+            pendingAuthenticationHeaders.set(lowerName, [value]);
+          }
+        } else {
+          targetHeaders.append(lowerName, value);
+        }
         nullHeaders.delete(lowerName);
       }
     }
   }
+  for (const values of pendingAuthenticationHeaders.values()) {
+    for (const value of values) {
+      assertAzureCredentialHeaderValue(value);
+    }
+  }
+  for (const [name, values] of pendingAuthenticationHeaders) {
+    for (const value of values) {
+      targetHeaders.append(name, value);
+    }
+  }
   return { [brand_privateNullableHeaders]: true, values: targetHeaders, nulls: nullHeaders };
 };
 

src/realtime/websocket.ts

@@ -1,4 +1,5 @@
 import type { AzureOpenAI } from '../index';
+import { assertAzureCredentialHeaderValue } from '../internal/azure';
 import { assertBedrockWebSocketOrigin } from '../internal/bedrock';
 import { OpenAI } from '../index';
 import { OpenAIError } from '../error';
@@ -125,6 +126,7 @@ function createAzureWebSocket(
     throw new Error('Azure OpenAI Realtime requires an API key');
   }
 
+  assertAzureCredentialHeaderValue(apiKey);
   redactAzureCredentials(url, isBearerToken);
   const socketURL = new URL(url);
   socketURL.searchParams.delete('api-key');

src/realtime/ws.ts

@@ -1,4 +1,5 @@
 import * as WS from 'ws';
+import { safeAzureWebSocketHeaders } from '../internal/azure';
 import { assertBedrockWebSocketOrigin } from '../internal/bedrock';
 import { protectWebSocketOptionsFromCredentialRedirects } from '../internal/ws';
 import type { AzureOpenAI } from '../index';
@@ -70,7 +71,7 @@ export class OpenAIRealtimeWS extends OpenAIRealtimeEmitter {
       this.url,
       protectWebSocketOptionsFromCredentialRedirects({
         ...props.options,
-        headers,
+        headers: isAzure(client) ? safeAzureWebSocketHeaders(headers) : headers,
       }),
     );