{"slug": "download-via-xet", "title": "Download via Xet", "summary": "Hugging Face's official documentation as of July 22, 2026, lists nine hostnames for downloads behind a proxy or firewall, including EU Xet endpoints and CDN/LFS endpoints, but omits cas-bridge.xethub.hf.co and cas.xethub.hf.co. The recommended change-resistant configuration is to allow hf.co and huggingface.co as suffixes covering all subdomains, as the hostnames may evolve with storage and CDN infrastructure changes.", "body_md": "Because this may change over time, I think the table in the current documentation is the most reliable reference:\n\nAs of July 22, 2026, the closest thing I can find to a current public answer is Hugging Face’s official [“Downloading behind a proxy or firewall” table](https://huggingface.co/docs/hub/models-downloading#downloading-behind-a-proxy-or-firewall).\n\nIt currently lists the following hostnames, all over HTTPS / port 443:\n\n```\nhuggingface.co\ncas-server.xethub.hf.co\ncas-server.xethub-eu.hf.co\ntransfer.xethub.hf.co\ntransfer.xethub-eu.hf.co\nus.aws.cdn.hf.co\nus.gcp.cdn.hf.co\ncdn-lfs-us-1.hf.co\ncdn-lfs-eu-1.hf.co\n```\n\nSo, compared with the current documentation, your list is not complete: it is missing the EU Xet endpoints and the current CDN/LFS endpoints.\n\nAt the same time, two names in your list are **not** in the current documented table:\n\n`cas-bridge.xethub.hf.co`\n\n`cas.xethub.hf.co`\n\nMy practical interpretation would therefore be:\n\n`hf.co`\n\nand `huggingface.co`\n\nsuffixes at arbitrary subdomain depth.The documentation itself explicitly warns that the hostnames may change as the storage and CDN infrastructure evolves.\n\nThe simplest and most change-resistant configuration is to allow:\n\n```\nhf.co\nhuggingface.co\n```\n\nas suffixes covering all subdomains.\n\nThis is different from assuming that a single-label wildcard such as `*.hf.co`\n\nmatches every nested name. Some firewall and proxy products would match:\n\n```\ncdn-lfs-us-1.hf.co\n```\n\nbut not deeper names such as:\n\n```\ncas-server.xethub.hf.co\nus.aws.cdn.hf.co\n```\n\nAlso:\n\n```\n*.xethub.hf.co\n```\n\ndoes not necessarily cover:\n\n```\ncas-server.xethub-eu.hf.co\ntransfer.xethub-eu.hf.co\n```\n\nbecause those are below `xethub-eu.hf.co`\n\n, not `xethub.hf.co`\n\n.\n\nThe exact behavior depends on whether the security product implements a true domain suffix rule, an RFC-style wildcard, or only one-label wildcard matching.\n\nI would start with the nine hostnames from the current documentation and treat that page as the operational reference.\n\nFor a controlled enterprise environment, it may also be useful to record:\n\n`huggingface_hub`\n\nand `hf_xet`\n\nbeing used;`hf download`\n\n, `from_pretrained`\n\n, Git, a browser, or another client;That makes it easier to distinguish a newly introduced endpoint from a TLS-inspection, proxy-routing, DNS, or client-specific problem.\n\nThe parts I think only Hugging Face can authoritatively confirm are:\n\n`cas-bridge.xethub.hf.co`\n\ncan still appear on any currently supported path;`cas.xethub.hf.co`\n\nis relevant to ordinary Hub downloads.One final caution: I would not rely on `HF_HUB_DISABLE_XET=1`\n\nas the main firewall strategy.\n\nIt can be useful for diagnosing whether behavior differs between client paths, but it does not guarantee that all downloads remain on `huggingface.co`\n\nor avoid the documented CDN hostnames. In at least one reported case, the non-Xet compatibility path still redirected to the same CDN endpoint.\n\nSo the default route I would use is:\n\n`hf.co`\n\nand `huggingface.co`\n\nwhere policy permits.`cas-bridge`\n\nlists as historical unless current traffic proves otherwise.", "url": "https://wpnews.pro/news/download-via-xet", "canonical_source": "https://discuss.huggingface.co/t/download-via-xet/178100#post_2", "published_at": "2026-07-22 12:28:07+00:00", "updated_at": "2026-07-22 12:34:38.700291+00:00", "lang": "en", "topics": ["developer-tools", "ai-infrastructure"], "entities": ["Hugging Face", "hf.co", "huggingface.co", "cas-server.xethub.hf.co", "cas-server.xethub-eu.hf.co", "transfer.xethub.hf.co", "transfer.xethub-eu.hf.co", "cdn-lfs-us-1.hf.co"], "alternates": {"html": "https://wpnews.pro/news/download-via-xet", "markdown": "https://wpnews.pro/news/download-via-xet.md", "text": "https://wpnews.pro/news/download-via-xet.txt", "jsonld": "https://wpnews.pro/news/download-via-xet.jsonld"}}