Merge pull request #27458 from alessandro-verzicco/ignore-auth-json-empty

Fix authentication fallback when X-Registry-Auth header contains empty JSON object

pkg/auth/auth.go

@@ -336,6 +336,9 @@ func parseMultiAuthHeader(authHeader string) (map[string]types.DockerAuthConfig,
 
 	// Now convert to the internal types.
 	authConfigs := make(map[string]types.DockerAuthConfig)
+	if len(dockerAuthConfigs) == 0 {
+		return nil, nil
+	}
 	for server := range dockerAuthConfigs {
 		authConfigs[server] = dockerAuthToImageAuth(dockerAuthConfigs[server])
 	}

pkg/auth/auth_test.go

@@ -392,6 +392,8 @@ func TestParseMultiAuthHeader(t *testing.T) {
 	}{
 		// Empty header
 		{input: "", expected: nil},
+		// Empty JSON object {}=e30= base64-encoded
+		{input: "e30=", expected: nil},
 		// "null"
 		{input: "null", expected: nil},
 		// Invalid JSON