{"record":{"id":"895b44f7479624aa","repo":"GoogleContainerTools/jib","slug":"www-authenticate-header-not-found","errorCode":null,"errorMessage":"'WWW-Authenticate' header not found","messagePattern":"'WWW-Authenticate' header not found","errorType":"http","errorClass":"RegistryErrorException","httpStatus":401,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/AuthenticationMethodRetriever.java","lineNumber":98,"sourceCode":"  }\n\n  @Override\n  public String getActionDescription() {\n    return \"retrieve authentication method for \" + registryEndpointRequestProperties.getServerUrl();\n  }\n\n  @Override\n  public Optional<RegistryAuthenticator> handleHttpResponseException(\n      ResponseException responseException) throws ResponseException, RegistryErrorException {\n    // Only valid for status code of '401 Unauthorized'.\n    if (responseException.getStatusCode() != HttpStatusCodes.STATUS_CODE_UNAUTHORIZED) {\n      throw responseException;\n    }\n\n    // Checks if the 'WWW-Authenticate' header is present.\n    String authenticationMethod = responseException.getHeaders().getAuthenticate();\n    if (authenticationMethod == null) {\n      throw new RegistryErrorExceptionBuilder(getActionDescription(), responseException)\n          .addReason(\"'WWW-Authenticate' header not found\")\n          .build();\n    }\n\n    // Parses the header to retrieve the components.\n    try {\n      return RegistryAuthenticator.fromAuthenticationMethod(\n          authenticationMethod, registryEndpointRequestProperties, userAgent, httpClient);\n\n    } catch (RegistryAuthenticationFailedException ex) {\n      throw new RegistryErrorExceptionBuilder(getActionDescription(), ex)\n          .addReason(\"Failed get authentication method from 'WWW-Authenticate' header\")\n          .build();\n    }\n  }\n}\n","sourceCodeStart":80,"sourceCodeEnd":115,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/AuthenticationMethodRetriever.java#L80-L115","documentation":"Built by AuthenticationMethodRetriever.handleHttpResponseException when the registry responds with an HTTP 401 but the response has no 'WWW-Authenticate' header. Jib needs that header (Bearer/Basic challenge) to learn where to authenticate, so without it the 401 cannot be resolved. It surfaces as RegistryErrorException with this reason.","triggerScenarios":"A registry (or an intermediary like a load balancer, proxy, or error page) returns 401 without the WWW-Authenticate challenge header during image push/pull.","commonSituations":"Corporate proxies or API gateways intercepting registry traffic, misconfigured reverse proxies returning bare 401s, or a non-Docker service listening on the registry port.","solutions":["Check whether a proxy, VPN, or gateway is intercepting the registry request and bypass/fix it.","Verify the registry hostname/port actually serves a Docker Registry v2 service (curl -v the /v2/ endpoint).","Confirm registry server configuration sends the WWW-Authenticate challenge on 401 responses.","Run `docker login` against the same registry to see if standard tooling faces the same problem."],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// preflight: the /v2/ endpoint must return a WWW-Authenticate challenge\n// curl -sv https://registry.example.com/v2/ 2>&1 | grep -i www-authenticate\n// a proper registry returns e.g. WWW-Authenticate: Bearer realm=\"...\"","typeGuard":null,"tryCatchPattern":"// catch and surface registry auth-challenge problems\ntry {\n    jibContainerBuilder.containerize();\n} catch (RegistryErrorException e) {\n    if (e.getMessage().contains(\"WWW-Authenticate\")) {\n        throw new IllegalStateException(\"Registry/proxy returned 401 without WWW-Authenticate — check proxy and registry config\", e);\n    }\n    throw e;\n}","preventionTips":["Bypass or correctly configure corporate proxies that intercept registry traffic.","Verify the target host is a Docker Registry v2 service before building.","Cross-check with `docker login` to isolate Jib-specific vs network-level issues."],"tags":["docker-registry","authentication","http-headers","network"],"backgroundTag":"authentication-required","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}