Container package registry login does not respect 2fa #9313

New Issue

GiteaMirror · 2025-11-02T08:34:58-06:00

GiteaMirror commented

2025-11-02 08:34:58 -06:00

Originally created by @TymanWasTaken on GitHub (Aug 1, 2022).

Description

In my gitea instance, I have configured 2fa on my account and it works fine, but I noticed when I tried to use the docker package registry, it only asked for my username and password, nothing else. I would expect 2fa to apply everywhere, however it doesn't look like the package registry (at least the container part, I haven't checked others) respects 2fa settings.

Gitea Version

1.17.0

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

As shown above (this is on try.gitea.io), I enabled 2fa on my account, however when logging in with docker all I had to enter was a simple username and password.

Git Version

No response

Operating System

No response

How are you running Gitea?

My own instance is hosted via docker, but I could also reproduce on https://try.gitea.io

Database

SQLite

Originally created by @TymanWasTaken on GitHub (Aug 1, 2022). ### Description In my gitea instance, I have configured 2fa on my account and it works fine, but I noticed when I tried to use the docker package registry, it only asked for my username and password, nothing else. I would expect 2fa to apply everywhere, however it doesn't look like the package registry (at least the container part, I haven't checked others) respects 2fa settings. ### Gitea Version 1.17.0 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots ![image](https://user-images.githubusercontent.com/32660892/182188349-533dd147-7a30-4ca8-91b7-2055577868dc.png) As shown above (this is on try.gitea.io), I enabled 2fa on my account, however when logging in with docker all I had to enter was a simple username and password. ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? My own instance is hosted via docker, but I could also reproduce on https://try.gitea.io ### Database SQLite

GiteaMirror added the type/question label 2025-11-02 08:34:58 -06:00

GiteaMirror closed this issue

2025-11-02 08:34:59 -06:00

GiteaMirror commented

2025-11-02 08:34:59 -06:00

@BaseCrusher commented on GitHub (Aug 1, 2022):

#20573
if you try to push an image you'll see that it won't work.
This said, you'll have to use an access token to use the registry with 2fa enabled.

@BaseCrusher commented on GitHub (Aug 1, 2022): #20573 if you try to push an image you'll see that it won't work. This said, you'll have to use an access token to use the registry with 2fa enabled.

GiteaMirror commented

2025-11-02 08:35:00 -06:00

@TymanWasTaken commented on GitHub (Aug 1, 2022):

I just tested it once again on try.gitea.io (I forgot to test pushing when I made the issue but I did this time):

Make an account
Enable 2fa
Login via docker with username and password (no 2fa or access token)
Pushed an image under my account

Additionally:

If I try to login with an incorrect password, and try to push an image, it fails with "authentication required", so inputting the correct password definitely logs in successfully without requiring any tokens or 2fa codes.
If I enter an access token instead of a password, the authentication succeeds and I can push an image, so access token login does work, but it does not seem to be enforced when 2fa is enabled

@TymanWasTaken commented on GitHub (Aug 1, 2022): I just tested it once again on `try.gitea.io` (I forgot to test pushing when I made the issue but I did this time): 1. Make [an account](https://try.gitea.io/tyman) 2. Enable 2fa 3. Login via docker with username and password (no 2fa or access token) 4. Pushed [an image](https://try.gitea.io/tyman/-/packages/container/pufferfish-server/1.19-25) under my account Additionally: 1. If I try to login with an incorrect password, and try to push an image, it fails with "authentication required", so inputting the correct password definitely logs in successfully without requiring any tokens or 2fa codes. 2. If I enter an access token instead of a password, the authentication succeeds and I can push an image, so access token login does work, but it does not seem to be enforced when 2fa is enabled

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9313