From f755f9ebbce23c0b856cbfdb0e9bed0e4b65eb2e Mon Sep 17 00:00:00 2001
From: Xi Xu <i@xi-xu.me>
Date: Fri, 25 Jul 2025 15:07:56 +0800
Subject: [PATCH] Pass 401 challenge for Docker authentication

When handling Docker authentication, the 401 challenge response is now passed through to the client to support proper authentication flows.
---
 src/index.js | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/index.js b/src/index.js
index 0e47fee..16602b8 100644
--- a/src/index.js
+++ b/src/index.js
@@ -330,6 +330,13 @@ async function handleRequest(request, env, ctx) {
 
     // If response is still not ok after all retries, return the error
     if (!response.ok && response.status !== 206) {
+      // For Docker authentication, we must pass the 401 challenge through
+      if (isDocker && response.status === 401) {
+        return new Response(response.body, {
+          status: response.status,
+          headers: new Headers(response.headers)
+        });
+      }
       const errorText = await response.text().catch(() => 'Unknown error');
       return new Response(`Upstream server error (${response.status}): ${errorText}`, {
         status: response.status,