Repository navigation
shield: proxy handler discards the upstream URL's path when forwarding requests #331
Description
In shieldProxyHandler in packages/guard/shield/shield.go, the line target := *upstream; target.Path = r.URL.Path (around line 122) overwrites the upstream URL's own Path field entirely with the incoming request's path, instead of joining the two. Any prefix configured on SOLONGATE_SHIELD_UPSTREAM or ANTHROPIC_BASE_URL, such as https://corp-proxy.example.com/llm, is silently dropped, and every proxied request goes to the upstream host's root path rather than under that prefix.
The fix is to join upstream.Path with r.URL.Path, for example with path.Join plus a check that the result keeps a leading slash, instead of assigning over target.Path.
Activity
fcy222fcy commentedon Nov 9, 2026
Opened #378 for this. Reproduced it against a live test upstream before changing anything: with the upstream URL set to
.../gateway/anthropic, a request for/v1/messagesreached the upstream as/v1/messages, so the prefix was gone exactly as described.The fix prefixes the request path with the upstream path instead of overwriting it, and keeps the request path otherwise untouched (dot segments, trailing slash and percent-encoding pass through), so shield still does not rewrite what the client asked for.
RawPathfollows the same join. Covered by tests for the prefixed case, an escaped request path, and prefixless upstreams (""and"/") so the common case does not regress.