{"record":{"id":"938002c3d1c0c686","repo":"amir20/dozzle","slug":"invalid-auth-realm-q-w","errorCode":null,"errorMessage":"invalid auth realm %q: %w","messagePattern":"invalid auth realm %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/imagecheck/registry.go","lineNumber":158,"sourceCode":"func (r *Registry) token(ctx context.Context, ref Reference, challenge string) (string, error) {\n\tkey := ref.host() + \"/\" + ref.Repository\n\n\tr.mu.Lock()\n\tif cached, ok := r.tokens[key]; ok && time.Now().Before(cached.expiresAt) {\n\t\tr.mu.Unlock()\n\t\tlog.Debug().Str(\"repository\", ref.Repository).Msg(\"image update check: reusing cached token\")\n\t\treturn cached.token, nil\n\t}\n\tr.mu.Unlock()\n\n\trealm, service := parseChallenge(challenge)\n\tif realm == \"\" {\n\t\treturn \"\", ErrAuthRequired\n\t}\n\n\tendpoint, err := url.Parse(realm)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid auth realm %q: %w\", realm, err)\n\t}\n\n\t// The realm is chosen by the registry, so it decides where Dozzle sends\n\t// its next request. Requiring TLS stops a hostile or compromised registry\n\t// from pointing that request at a plaintext internal address such as a\n\t// cloud metadata endpoint. Loopback registries are exempt for the same\n\t// reason they are allowed over HTTP at all.\n\tif err := validateRealm(endpoint, ref); err != nil {\n\t\treturn \"\", err\n\t}\n\tquery := endpoint.Query()\n\tif service != \"\" {\n\t\tquery.Set(\"service\", service)\n\t}\n\tquery.Set(\"scope\", \"repository:\"+ref.Repository+\":pull\")\n\tendpoint.RawQuery = query.Encode()\n\n\treq, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint.String(), nil)","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/amir20/dozzle/blob/d9463cbe21874e44ab79db6fa63e746ca7d22928/internal/imagecheck/registry.go#L140-L176","documentation":"In Registry.token the WWW-Authenticate challenge's realm string could not be parsed as a URL (url.Parse failed), so the registry returned a malformed token endpoint. The registry URL comes from the registry's own response header, meaning the upstream registry is misbehaving; the error wraps the underlying parse error via %w.","triggerScenarios":"Thrown at internal/imagecheck/registry.go:158 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the registry's WWW-Authenticate header; the realm must be an absolute URL.","Retry the check later if the registry is misconfigured server-side.","Treat image update checks as best-effort: log and skip the update check instead of failing the request."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9463cbe21874e44ab79db6fa63e746ca7d22928","analyzedAt":"2026-09-07T10:08:55.855Z","contentChangedAt":"2026-09-07T10:08:55.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}