# Problem with Docker Baerer Token URL after upgrade to 3.80

**URL:** <https://community.sonatype.com/t/problem-with-docker-baerer-token-url-after-upgrade-to-3-80/15418>\
**Category:** Sonatype Nexus Repository\
**Tags:** docker, nexus-repository\
**Created:** [August 18, 2025, 1:03pm UTC](https://community.sonatype.com/t/problem-with-docker-baerer-token-url-after-upgrade-to-3-80/15418 "2025-08-18T13:03:58Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Dirk\_Heuvels](https://avatars.discourse-cdn.com/v4/letter/d/258eb7/32.png) [@Dirk\_Heuvels](https://community.sonatype.com/u/Dirk_Heuvels)\
**Post date:** [August 18, 2025, 1:03pm UTC](https://community.sonatype.com/t/problem-with-docker-baerer-token-url-after-upgrade-to-3-80/15418/1 "2025-08-18T13:03:58Z")

</div>

I am running a Nexus Docker Registry with a HTTP connector behind an Apache reverse proxy.  
The setup is pretty much the one [recommended by Sonatype](https://help.sonatype.com/en/run-behind-a-reverse-proxy.html#apache-httpd-161989-2_body).

Communication looks like this:

```auto
docker pull ---> https://my-registry-server:10443 (Apache) ---> http://127.0.0.1:10080 (Nexus)

```

This has always worked fine, also for anonymous `docker pull` requests requiring the [Docker Bearer Token](https://help.sonatype.com/en/docker-authentication.html). But after upgrading to Nexus 3.80.0-06 anonymous access stopped working and debugging showed, that the `WWW-Authenticate` Header sent back from Nexus had a bad token URL like this:

```auto
Bearer realm="https://my-registry-server:10443:10443/v2/token",service="https://my-registry-server:10443:10443/v2/token"

```

Nexus seems to construct the URL from the `X-Forwarded-*` Headers and I played around with them by setting `ProxyAddHeaders off` and then individual values for 'RequestHeader set `X-Forwarded-XX ".."`, but without success.  
I ended up overwriting the “WWW-Authenticate” header created by Nexus in all responses like this:

```auto
Header set WWW-Authenticate 'Bearer realm="https://my-registry-server:10443/v2/token"'

```

Although that works, it feels a little blunt. Did anybody experience the same problem?  
I have another nexus running in a test stage on 3.82.0-08, but that shows the same behaviour.

BR,  
Dirk

---

_[View the full topic](https://community.sonatype.com/t/problem-with-docker-baerer-token-url-after-upgrade-to-3-80/15418)._