We are currently using JFrog Container Registry license 7.59.12 rev 75912900 as a fallback source for our serverless registry setup at https://github.com/cloudflare/serverless-registry.

When we disable authentication on JCR, the fallback mechanism works flawlessly. However, once authentication is enabled, we encounter persistent 401 Unauthorized errors, regardless of whether we use a password or a token for authentication.

Code Snippet:

const params = new URLSearchParams({
  service: ctx.service,
  // explicitly include that we don't want an offline_token.
  scope: `repository:${this.url.pathname.slice(1)}/image:pull,push`,
  client_id: "r2registry",
  grant_type: "password",
  username: this.configuration.username,
  password: this.password(),
});

let res = await fetch(ctx.realm, {
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
    "User-Agent": "Docker-Client/24.0.5 (linux)",
  },
  method: "POST",
  body: params.toString(),
});

Additional Information:

The same authentication logic works seamlessly with Google Container Registry (GCR) and Docker Hub.

We’ve ensured that the username and password/token are correctly configured and tested them separately with direct API calls.

Why does this code result in a 401 error with JFrog Container Registry, while it functions correctly with GCR and Docker Hub? Could there be specific configurations or headers required by JCR that we might be missing?