{"record":{"id":"92b0a3f53dbf5b50","repo":"docker/cli","slug":"invalid-auth-configuration-file","errorCode":null,"errorMessage":"invalid auth configuration file","messagePattern":"invalid auth configuration file","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/config/configfile/file.go","lineNumber":314,"sourceCode":"// decodeAuth decodes a base64 encoded string and returns username and password\nfunc decodeAuth(authStr string) (string, string, error) {\n\tif authStr == \"\" {\n\t\treturn \"\", \"\", nil\n\t}\n\n\tdecLen := base64.StdEncoding.DecodedLen(len(authStr))\n\tdecoded := make([]byte, decLen)\n\tauthByte := []byte(authStr)\n\tn, err := base64.StdEncoding.Decode(decoded, authByte)\n\tif err != nil {\n\t\treturn \"\", \"\", err\n\t}\n\tif n > decLen {\n\t\treturn \"\", \"\", errors.New(\"something went wrong decoding auth config\")\n\t}\n\tuserName, password, ok := strings.Cut(string(decoded), \":\")\n\tif !ok || userName == \"\" {\n\t\treturn \"\", \"\", errors.New(\"invalid auth configuration file\")\n\t}\n\treturn userName, strings.Trim(password, \"\\x00\"), nil\n}\n\n// GetCredentialsStore returns a new credentials store from the settings in the\n// configuration file\nfunc (c *ConfigFile) GetCredentialsStore(registryHostname string) credentials.Store {\n\tstore := credentials.NewFileStore(c)\n\n\tif helper := getConfiguredCredentialStore(c, getAuthConfigKey(registryHostname)); helper != \"\" {\n\t\tstore = newNativeStore(c, helper)\n\t}\n\n\tenvConfig := os.Getenv(DockerEnvConfigKey)\n\tif envConfig == \"\" {\n\t\treturn store\n\t}\n","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/cli/config/configfile/file.go#L296-L332","documentation":"Returned by decodeAuth after successfully base64-decoding the auth string: it splits the result on the first ':' to separate username and password. If there is no ':' (strings.Cut returns ok=false) or the username portion is empty, the auth entry is considered malformed. A valid auth credential must be 'username:secret'.","triggerScenarios":"The 'auth' field in config.json (or in DOCKER_AUTH_CONFIG) base64-decodes to a string with no colon, or to ':password' (empty username). Hand-crafted base64 where someone encoded only a token, or encoded 'password' without a username.","commonSituations":"A user base64-encodes only an access token (no colon) when configuring registry auth. Migrating credentials from another tool that stores a bare token. Editing config.json and pasting a token directly instead of 'user:token'.","solutions":["Regenerate the entry with 'docker login' so it stores a correct base64('username:password-or-token').","Manually fix the value: echo -n 'username:token' | base64, then place the output in the 'auth' field.","Ensure the credential includes both a username and a colon separator before encoding."],"exampleFix":"# before (broken - no colon)\nauth: $(echo -n 'mytoken' | base64)\n# after\nauth: $(echo -n 'oauth2:mytoken' | base64)","handlingStrategy":"validation","validationCode":"// Pre-validate a base64 auth string decodes to user:secret before storing.\nfunc validAuthB64(s string) error {\n    dec, err := base64.StdEncoding.DecodeString(s)\n    if err != nil { return err }\n    if _, _, ok := strings.Cut(string(dec), \":\"); !ok {\n        return errors.New(\"decoded auth must be 'username:secret'\")\n    }\n    return nil\n}","typeGuard":"func isUserSecretAuth(b64 string) bool {\n    dec, err := base64.StdEncoding.DecodeString(b64)\n    if err != nil { return false }\n    u, _, ok := strings.Cut(string(dec), \":\")\n    return ok && u != \"\"\n}","tryCatchPattern":null,"preventionTips":["Always encode 'username:token', never a bare token.","Use 'docker login' to populate config.json correctly.","In CI, generate the value with printf '%s:%s' \"$USER\" \"$TOKEN\" | base64."],"tags":["config","auth","config-json","base64","validation"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}