I’m not sure if this is the right forum to track this issue. If not, please point me to the correct spot.
When authenticating to Docker Hardened Images with the standard Docker Registry v2 bearer-token flow, we’re seeing that once a cached access token expires, DHI responds to the next request with 401 Unauthorized but omits the WWW-Authenticate challenge header. Normally a 401 comes back with a WWW-Authenticate: Bearer realm=…,service=… header that tells the client where to re-acquire a token — that’s the signal clients use to refresh and retry; without it there’s nothing to trigger a refresh, and the pull fails until the token is otherwise rotated. This differs from dhi.io 's own base /v2/ endpoint, which does return the usual Bearer realm="https://dhi.io/token",service="registry.docker.io" challenge (it even adds error=“invalid_token” ) for missing or invalid tokens. The missing challenge specifically on the expired-token path is the gap.
I’d appreciate if you’d consider updating the API behavior