# Problem with Docker Baerer Token URL after upgrade to 3.80

I am running a Nexus Docker Registry with a HTTP connector behind an Apache reverse proxy.

The setup is pretty much the one [recommended by Sonatype](https://help.sonatype.com/en/run-behind-a-reverse-proxy.html#apache-httpd-161989-2_body).

Communication looks like this:

```perl
docker pull ---> https://my-registry-server:10443 (Apache) ---> http://127.0.0.1:10080 (Nexus)
```

This has always worked fine, also for anonymous `docker pull` requests requiring the [Docker Bearer Token](https://help.sonatype.com/en/docker-authentication.html). But after upgrading to Nexus 3.80.0-06 anonymous access stopped working and debugging showed, that the `WWW-Authenticate` Header sent back from Nexus had a bad token URL like this:

```bash
Bearer realm="https://my-registry-server:10443:10443/v2/token",service="https://my-registry-server:10443:10443/v2/token"
```

Nexus seems to construct the URL from the `X-Forwarded-*` Headers and I played around with them by setting `ProxyAddHeaders off` and then individual values for 'RequestHeader set `X-Forwarded-XX ".."`, but without success.

I ended up overwriting the “WWW-Authenticate” header created by Nexus in all responses like this:

```bash
Header set WWW-Authenticate 'Bearer realm="https://my-registry-server:10443/v2/token"'
```

Although that works, it feels a little blunt. Did anybody experience the same problem?

I have another nexus running in a test stage on 3.82.0-08, but that shows the same behaviour.

BR,

Dirk

---

After update to 3.88.0-08 recently, the problem has gone away and the workaround described above is not necessary anymore.