{"record":{"id":"c98d75debc47aa9b","repo":"GoogleContainerTools/jib","slug":"bearer-was-not-found-in-the-www-authenticate-h","errorCode":null,"errorMessage":"'Bearer' was not found in the 'WWW-Authenticate' header, tried to parse: ${authenticationMethod}","messagePattern":"'Bearer' was not found in the 'WWW-Authenticate' header, tried to parse: (.+?)","errorType":"exception","errorClass":"RegistryAuthenticationFailedException","httpStatus":null,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java","lineNumber":85,"sourceCode":"   *     href=\"https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate\">https://docs.docker.com/registry/spec/auth/token/#how-to-authenticate</a>\n   */\n  static Optional<RegistryAuthenticator> fromAuthenticationMethod(\n      String authenticationMethod,\n      RegistryEndpointRequestProperties registryEndpointRequestProperties,\n      @Nullable String userAgent,\n      FailoverHttpClient httpClient)\n      throws RegistryAuthenticationFailedException {\n    // If the authentication method starts with 'basic' (case insensitive), no registry\n    // authentication is needed.\n    if (authenticationMethod.matches(\"^(?i)(basic).*\")) {\n      return Optional.empty();\n    }\n\n    String registryUrl = registryEndpointRequestProperties.getServerUrl();\n    String imageName = registryEndpointRequestProperties.getImageName();\n    // Checks that the authentication method starts with 'bearer ' (case insensitive).\n    if (!authenticationMethod.matches(\"^(?i)(bearer) .*\")) {\n      throw newRegistryAuthenticationFailedException(\n          registryUrl, imageName, authenticationMethod, \"Bearer\");\n    }\n\n    Pattern realmPattern = Pattern.compile(\"realm=\\\"(.*?)\\\"\");\n    Matcher realmMatcher = realmPattern.matcher(authenticationMethod);\n    if (!realmMatcher.find()) {\n      throw newRegistryAuthenticationFailedException(\n          registryUrl, imageName, authenticationMethod, \"realm\");\n    }\n    String realm = realmMatcher.group(1);\n\n    Pattern servicePattern = Pattern.compile(\"service=\\\"(.*?)\\\"\");\n    Matcher serviceMatcher = servicePattern.matcher(authenticationMethod);\n    // use the provided registry location when missing service (e.g., for OpenShift)\n    String service = serviceMatcher.find() ? serviceMatcher.group(1) : registryUrl;\n\n    return Optional.of(\n        new RegistryAuthenticator(","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/RegistryAuthenticator.java#L67-L103","documentation":"Jib parses the WWW-Authenticate header of a registry's 401 response to obtain a bearer token. It only supports 'Bearer' authentication; if the header's scheme is not 'Bearer ' (case-insensitive), the authentication handshake fails with this error naming the unsupported method.","triggerScenarios":"A registry returns a WWW-Authenticate header whose scheme is Basic, Digest, Negotiate, or otherwise not 'Bearer ...' when Jib requests the image.","commonSituations":"Pulling from registries that only support HTTP Basic auth without a token service; misconfigured authentication proxies; corporate registry mirrors with non-standard auth.","solutions":["Configure the registry to use token (Bearer) authentication with a proper auth service, or use a standard registry implementation","Ensure correct credentials are supplied via docker login / Jib auth configuration so the registry issues Bearer challenges","Use an HTTPS, spec-compliant registry or mirror (e.g. registry:2 with token auth)","Check that a proxy in front of the registry is not stripping or replacing the WWW-Authenticate header"],"exampleFix":"// registry auth before: auth enforced by reverse proxy (Basic only)\n// after: run registry v2 with token service\nREGISTRY_AUTH=token \\\nREGISTRY_AUTH_TOKEN_REALM=https://auth.example.com/token \\\nREGISTRY_AUTH_TOKEN_SERVICE=registry.example.com \\\nregistry:2","handlingStrategy":"validation","validationCode":"// inspect the challenge before building\nHttpURLConnection c = (HttpURLConnection) new URL(\"https://registry/v2/\").openConnection();\nString wwwAuth = c.getHeaderField(\"WWW-Authenticate\");\nif (wwwAuth == null || !wwwAuth.matches(\"(?i)bearer .*\")) {\n  throw new IllegalStateException(\"Registry does not offer Bearer auth: \" + wwwAuth);\n}","typeGuard":null,"tryCatchPattern":"try {\n  jibBuild.containerize(...);\n} catch (RegistryAuthenticationException e) {\n  // fall back to explicit credentials or a compliant registry\n  configureCredentialsManually(e);\n}","preventionTips":["Prefer registries with standard token-based (Bearer) auth","docker login first so credential helpers supply working credentials","Check WWW-Authenticate headers with curl when adding a new registry"],"tags":["registry","authentication","docker","www-authenticate"],"backgroundTag":"authentication-required","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}