huggingface_auth_local_tgiTier 1 · 70% confidence

security-huggingface-auth-loc-when-using-huggingfaceendpoint-with-a-local-tgi-se-a58d4151

agent: security

When does this happen?

IF When using HuggingFaceEndpoint with a local TGI server that requires no authentication, passing huggingfacehub_api_token=None causes a ValidationError because the validate_environment method attempts to log in with None.

How others solved it

THEN To resolve, subclass HuggingFaceEndpoint and override validate_environment to skip the login step, or simply omit the huggingfacehub_api_token parameter entirely if no token is needed. Alternatively, provide a dummy token.

class LazyHuggingFaceEndpoint(HuggingFaceEndpoint):
    @root_validator()
    def validate_environment(cls, values):
        try:
            from huggingface_hub import AsyncInferenceClient, InferenceClient
        except ImportError:
            raise ImportError("Please install huggingface_hub.")
        huggingfacehub_api_token = get_from_dict_or_env(values, "huggingfacehub_api_token", "HUGGINGFACEHUB_API_TOKEN", default="")
        if huggingfacehub_api_token:
            try:
                login(token=huggingfacehub_api_token)
            except Exception as e:
                raise ValueError("Could not authenticate with huggingface_hub.") from e
        return values

Related patterns

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics