Remove Authorization header when following redirects (#1345)

huggingface · Feb 17, 2023 · 4d3d150 · 4d3d150
1 parent d7378dd
commit 4d3d150
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/huggingface_hub/file_download.py b/src/huggingface_hub/file_download.py
@@ -683,6 +683,7 @@ def cached_download(
             # Useful for lfs blobs that are stored on a CDN.
             if 300 <= r.status_code <= 399:
                 url_to_download = r.headers["Location"]
+                headers.pop("authorization", None)
         except (requests.exceptions.SSLError, requests.exceptions.ProxyError):
             # Actually raise for those subclasses of ConnectionError
             raise