Merge pull request #954 from jakedt/badcreds

Return a 401 when doing a login with bad credentials

endpoints/v2/v2auth.py

@@ -103,6 +103,10 @@ def generate_registry_jwt():
       'actions': actions,
     })
 
+  elif user is None and token is None:
+    # In this case, we are doing an auth flow, and it's not an anonymous pull
+    return abort(401)
+
   token_data = {
     'iss': app.config['JWT_AUTH_TOKEN_ISSUER'],
     'aud': audience_param,