{"record":{"id":"bdf02c1552583280","repo":"amir20/dozzle","slug":"auth-realm-q-has-no-host","errorCode":null,"errorMessage":"auth realm %q has no host","messagePattern":"auth realm %q has no host","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/imagecheck/registry.go","lineNumber":233,"sourceCode":"\t// The token itself is a credential and is deliberately never logged.\n\tlog.Debug().\n\t\tStr(\"repository\", ref.Repository).\n\t\tStr(\"realm\", realm).\n\t\tDur(\"ttl\", ttl).\n\t\tMsg(\"image update check: obtained registry token\")\n\n\tr.mu.Lock()\n\t// Expire the token a little early so a request never races the deadline.\n\tr.tokens[key] = cachedToken{token: token, expiresAt: time.Now().Add(ttl - 10*time.Second)}\n\tr.mu.Unlock()\n\n\treturn token, nil\n}\n\n// validateRealm restricts where a registry can send us for a token.\nfunc validateRealm(endpoint *url.URL, ref Reference) error {\n\tif endpoint.Host == \"\" {\n\t\treturn fmt.Errorf(\"auth realm %q has no host\", endpoint)\n\t}\n\n\tif endpoint.Scheme == \"https\" {\n\t\treturn nil\n\t}\n\n\t// A loopback registry is already trusted over plain HTTP, but only for\n\t// itself: it cannot send us to some other host in the clear.\n\tif endpoint.Scheme == \"http\" && ref.Insecure() && sameHost(endpoint.Host, ref.Registry) {\n\t\treturn nil\n\t}\n\n\treturn fmt.Errorf(\"refusing auth realm %q: must be https\", endpoint)\n}\n\nfunc sameHost(a, b string) bool {\n\treturn strings.EqualFold(a, b)\n}","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/amir20/dozzle/blob/d9463cbe21874e44ab79db6fa63e746ca7d22928/internal/imagecheck/registry.go#L215-L251","documentation":"validateRealm is a security guard: a registry's challenge redirected Dozzle to a token endpoint URL with no host component (e.g. a relative realm), which cannot be validated as a safe HTTPS endpoint. Dozzle refuses to send credentials to it.","triggerScenarios":"Thrown at internal/imagecheck/registry.go:233 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Skip the image update check for this registry; it is responding with a malformed challenge.","If it is a self-hosted registry, fix its WWW-Authenticate realm to an absolute URL including scheme and host.","Report the issue to the registry operator; this is a server-side configuration error."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d9463cbe21874e44ab79db6fa63e746ca7d22928","analyzedAt":"2026-09-07T10:08:55.855Z","contentChangedAt":"2026-09-07T10:08:55.855Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}