From dc582b0fe29834b9993fb02f0fe856b92afe64f1 Mon Sep 17 00:00:00 2001
From: Talmaj Marinc <talmaj@comfy.org>
Date: Tue, 30 Jun 2026 20:31:33 +0200
Subject: [PATCH] Remove sending url info over websockets for model downloads.

---
 server.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/server.py b/server.py
index fff646c73..6dd293f92 100644
--- a/server.py
+++ b/server.py
@@ -1218,7 +1218,12 @@ class PromptServer():
             try:
                 view = DOWNLOAD_MANAGER.status_sync(download_id)
                 if view is not None:
-                    self.send_sync("download_progress", view)
+                    # Drop the url field before broadcasting: the redacted URL
+                    # (scheme + host + path) should not leak to every connected
+                    # websocket client. download_id / model_id are sufficient to
+                    # correlate progress on the frontend.
+                    broadcast = {k: v for k, v in view.items() if k != "url"}
+                    self.send_sync("download_progress", broadcast)
             except Exception:
                 logging.debug("download progress notify failed", exc_info=True)