[Bug]: OCI registry with AWS ECR
thepabloaguilar opened this issue · comments
Bug Description
Hi guys, it's me (again 😆)! I've found something with the ECR integration that I was unable to see while the auth token doesn't expire and now with a stable deployment I started to see it.
The thing is, using the aws-sdk is indeed working to get the authorization token but when the token expires it doens't get refreshed by oras and the reason is simple, the returned error by the ECR API is:
response status code 403: denied: Your authorization token has expired. Reauthenticate and try again.
The response returned a 403 and not a 401, the key difference is: 401 returns the auth challange (Www-Authenticate header) and 403 don't! So we never get re-authenticadet again because oras only will call the credentials function if a challange is returned.
Version Info
Search
- I searched for other open and closed issues before opening this
Steps to Reproduce
Configures a Flipt instance using OCI with AWS ECR and wait the auth token to expire!
Expected Behavior
After the token expires it should be able to re-authenticated again!
Additional Context
No response
A possible solution to this problem is:
- Disable cache when
aws-ecris chosen as we know the ECR API will always return a 403 when to token has expired - Modify the ECR struct to keep track when the token expire and renew the auth token some minutes before
I could work on this if needed
In fact it doesn't reach the challange piece of code, oras has this check:
if resp.StatusCode != http.StatusUnauthorized {
return resp, nil
}In this bug the response status is "Forbidden" which will make the if statement condition to pass
Hey @thepabloaguilar.
Thank you for the report.
I still need to read more AWS docs when http code 403 could be returned to finalize it. What do you think about #3044?
In fact it doesn't reach the challange piece of code, oras has this check:
if resp.StatusCode != http.StatusUnauthorized { return resp, nil }In this bug the response status is "Forbidden" which will make the if statement condition to pass
@thepabloaguilar thanks for reporting! would this be a bug in ORAS then that we could open/issue a patch for? or do you think its only related to how we are using the ORAS client?
That's a great question @markphelps, I think it's not ORAS issue since it's behaving as it should be as the challange is only returned by Forbidden status code. I do think it's an AWS Issue, at least for my understanding because I think if my token is expired I'm not forbbiden, I'm unauthorized, I no longer have a valid token so I don't have access to anything
Hey @thepabloaguilar.
Thank you for the report.
I still need to read more AWS docs when http code 403 could be returned to finalize it. What do you think about #3044?
I like @erka 's solution here! Just need to update to add the header like @thepabloaguilar mentioned
Me too @markphelps, that should be enough
Fixed by the @erka PR