{"record":{"id":"9e87a8663d5485f3","repo":"amir20/dozzle","slug":"refusing-auth-realm-q-must-be-https","errorCode":null,"errorMessage":"refusing auth realm %q: must be https","messagePattern":"refusing auth realm %q: must be https","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/imagecheck/registry.go","lineNumber":246,"sourceCode":"}\n\n// validateRealm restricts where a registry can send us for a token.\nfunc validateRealm(endpoint *url.URL, ref Reference) error {\n\tif endpoint.Host == \"\" {\n\t\treturn fmt.Errorf(\"auth realm %q has no host\", endpoint)\n\t}\n\n\tif endpoint.Scheme == \"https\" {\n\t\treturn nil\n\t}\n\n\t// A loopback registry is already trusted over plain HTTP, but only for\n\t// itself: it cannot send us to some other host in the clear.\n\tif endpoint.Scheme == \"http\" && ref.Insecure() && sameHost(endpoint.Host, ref.Registry) {\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"refusing auth realm %q: must be https\", endpoint)\n}\n\nfunc sameHost(a, b string) bool {\n\treturn strings.EqualFold(a, b)\n}\n\n// parseChallenge pulls realm and service out of a Bearer WWW-Authenticate\n// header, e.g. `Bearer realm=\"https://auth.docker.io/token\",service=\"registry.docker.io\"`.\nfunc parseChallenge(header string) (realm string, service string) {\n\tif !strings.HasPrefix(strings.ToLower(header), \"bearer \") {\n\t\treturn \"\", \"\"\n\t}\n\n\tfor part := range strings.SplitSeq(header[len(\"bearer \"):], \",\") {\n\t\tkey, value, found := strings.Cut(strings.TrimSpace(part), \"=\")\n\t\tif !found {\n\t\t\tcontinue\n\t\t}","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/amir20/dozzle/blob/d9463cbe21874e44ab79db6fa63e746ca7d22928/internal/imagecheck/registry.go#L228-L264","documentation":"validateRealm refuses to fetch a registry token from a realm that is not HTTPS. The only exception is plain HTTP on loopback registries explicitly marked insecure and pointing at the same host as the registry itself. This prevents a registry (or a MITM) from redirecting token requests to an insecure third-party host.","triggerScenarios":"Thrown at internal/imagecheck/registry.go:246 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Serve the token endpoint over HTTPS; plain HTTP realms are rejected by design.","For a local dev registry, mark it insecure so loopback HTTP to the same host is allowed.","If the realm host is intentionally different, it must still use HTTPS."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9463cbe21874e44ab79db6fa63e746ca7d22928","analyzedAt":"2026-09-07T10:08:55.855Z","contentChangedAt":"2026-09-07T10:08:55.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}