apple / apple/container

[Bug]: Basic-auth registry failures expose `missing Bearer challenge`

Open
#1,538 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
49.9k
Forks
1.8k
Avg merge
1d 20h
Merged PRs (30d)
22

Description

### I have done the following

- [x] I have searched the existing issues
- [x] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

Start a local Basic-auth registry and log in with the wrong password:

```console
$ htpasswd -Bbn issue-user issue-password > "/Users/ras/Downloads/test_container/audit_artifacts/container-issue-repros-20260511-101939/tmp/auth-registry/htpasswd"

$ container run --name issue-auth-registry --detach --publish 127.0.0.1:5056:5000 --mount type=bind,source=/Users/ras/Downloads/test_container/audit_artifacts/container-issue-repros-20260511-101939/tmp/auth-registry,target=/auth,readonly -e REGISTRY_AUTH=htpasswd -e REGISTRY_AUTH_HTPASSWD_REALM=IssueRegistry -e REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd registry:2
[0/6] [0s]
[1/6] Fetching image [0s]
[1/6] Fetching image [1s]
[1/6] Fetching image 11% (3 of 8 blobs, 1.1/9.0 MB, 7 KB/s) [2s]
[2/6] Unpacking image [2s]
[2/6] Unpacking image for platform linux/arm64/v8 [2s]
[3/6] Fetching kernel [3s]
[4/6] Fetching init image [3s]
[5/6] Unpacking init image [3s]
[6/6] Starting container [3s]
[6/6] Starting container [4s]
issue-auth-registry

$ curl -sS -i http://127.0.0.1:5056/v2/
HTTP/1.1 401 Unauthorized
Content-Type: application/json; charset=utf-8
Docker-Distribution-Api-Version: registry/2.0
Www-Authenticate: Basic realm="IssueRegistry"
X-Content-Type-Options: nosniff
Date: Mon, 11 May 2026 17:22:00 GMT
Content-Length: 87

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":null}]}

$ curl -sS -i -u issue-user:issue-password http://127.0.0.1:5056/v2/
HTTP/1.1 200 OK
Content-Length: 2
Content-Type: application/json; charset=utf-8
Docker-Distribution-Api-Version: registry/2.0
X-Content-Type-Options: nosniff
Date: Mon, 11 May 2026 17:22:00 GMT

{}

$ printf 'wrong-password\n' | container registry login --scheme http --username issue-user --password-stdin 127.0.0.1:5056
Error: HTTP request to http://127.0.0.1:5056/v2/ failed with response: 401 Unauthorized. Reason: invalidArgument: "missing Bearer challenge in WWW-Authenticate header"

$ echo $?
1
```

### Problem description

For a Basic-auth registry, wrong-password and missing-credential failures should report an authentication problem. The current error exposes an internal Bearer challenge diagnostic and makes a valid Basic-auth registry look protocol-incompatible.

### Environment

```markdown
- OS: macOS 26.4.1 (25E253)
- Xcode: Xcode 26.4.1 (17E202)
- Container: container CLI 0.12.3 (build: release, commit: f989901)
```

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Research direction

Start with the `container registry login --scheme http` entry point and reproduce the failure against the Basic-auth `registry:2` setup shown in the issue. Trace how the 401 `WWW-Authenticate: Basic` response is handled, then verify that wrong-password and missing-credential cases report an authentication problem rather than the missing Bearer challenge diagnostic.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, swift
Domain
authentication, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.