Hacktoberfest 2026: as issues que os mantenedores marcaram para outubro, abertas e boas para iniciantes. Ver issues do Hacktoberfest

[Bug] Interactive auth callback hangs forever when an idle connection reaches AuthCodeReceiver first

Aberta
  • Algo errado?
#950 2 comentários 3 reações 0 responsáveis Ver no GitHub

@Thanatos9404 já está trabalhando nisso.

Desde 15/10/2026.

  • #971 de @Thanatos9404 — aberto

Avaliação

Dificuldade
4/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
48/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
python
Domínio
authentication, backend

Direção de pesquisa

Start by reading AuthCodeReceiver and its use of HttpServer; the issue identifies synchronous request handling and a connection accepted before the OAuth POST as the suspected path. Reproduce the flow with an idle connection reaching the listener first, then check that the real OAuth POST is processed and az login completes. The issue does not name a test file.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

bug public-client

Describe the bug
When I run az login in my VS code terminal (using the VS Code SSH extension to connect to my Linux VM), it either succeeds, or it hangs forever after I log in via the browser until I close the browser and cancel the command. If I retry a couple of times, sometimes 1 succeeds. (Sometimes I spam 10x and it'll work once - fairly annoying).

To Reproduce
Steps to reproduce the behavior:

  1. Use the VS Code SSH extension to connect to a Linux VM
  2. az login on the VM (not with device code, this is using interactive auth via the browser)
  3. Login using the browser
  4. Login either works fine, or hangs forever

Expected behavior
The normal flow, looking at the code-

  1. az cli asks MSAL to perform interactive auth
  2. MSAL creates a temp HTTP server on a port and registers a redirect URI
  3. az cli opens the entra login auth page in the browser
  4. after auth, entra should be returning an HTML form that the browser POSTs to the redirect URI
  5. VS Code remote SSH forwards the local connection to that port on the Linux machine
  6. MSAL reads the auth code from the POST and does the token exchange

TLDR: the local browser should POST to the localhost port on the VS code tunnel, then to the MSAL HTTP server, before returning the auth code to az cli.

What you see instead

  1. MSAL was listening on the redirect port, ex. 39397
  2. An idle TCP connection arrives from a different ephemeral source port (this could really be from anything, but I'm guessing it has to do with the VS code remote SSH behavior - I think it shouldn't matter, though).
  3. MSAL accepted that connection
  4. It was an empty connection - no requests arrive
  5. The real OAuth POST arrives from a different port
  6. The real OAuth POST sits in the server's request queue forever
Accepted idle connection:
127.0.0.1:39397 <-> 127.0.0.1:40890
Recv-Q: 0

Queued real callback:
127.0.0.1:39397 <-> 127.0.0.1:40902
Recv-Q: 3026

The MSAL Python version you are using

  • Azure CLI: 2.89.0
  • MSAL Python: 1.36.0
  • Also present in MSAL Python 1.37.0 source
  • Python: Azure CLI bundled Python 3.14
  • OS: Ubuntu 22.04
  • Client: VS Code Remote SSH with a Windows browser

Additional context
I think this is a race condition and if the OAuth connection reaches the listening port first, everything works fine.
A few things I noticed:

  1. AuthCodeReceiver is using HttpServer, which I think is singled threaded. I can't find the GitHub link, but looking at the handler in Python source it looks like we process the request synchronously and don't accept another connection until the handler is done
  2. self._server.timeout = timeout in AuthCodeReceiver is for accepting new requests, but this hang should be happening after the initial accept - we're just waiting for the request bytes
Linguagem predominante
Python
Estrelas
971
Forks
223
Merge médio
3h 6min
PRs com merge (30d)
4

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de AzureAD/microsoft-authentication-library-for-python

Todas as issues de AzureAD/microsoft-authentication-library-for-python

Issues semelhantes

Mais issues de Python

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.