Share via

msal-node throws 'ClientAuthError: network_error: Network request failed' on 'acquireTokenByCode' when executed in a Docker container

Stefano Cappa 0 Reputation points
2026-02-19T11:45:38.7633333+00:00

I'm using msal-node 3.8.6 and this example https://github.com/AzureAD/microsoft-authentication-library-for-js/tree/dev/samples/msal-node-samples/auth-code-pkce.
If I run my application with nodejs on my Windows PC everything looks good. I get the code on redirect/callback and finally I can acquire a valid JWT.

If I try to put the same code inside a docker container (based on node:lts-trixie from dockerhub, but the same happens with alpine) I receive 'network_error: Network request failed' error on 'acquireTokenByCode' and I don't understand why. It seems related to the network and/or to the container, but I don't understand how to debug it, because it's an error thrown inside the library.

This is the piece of code that throws the error and it's the same as the one in the official sample (I changed redirect path obviously) https://github.com/AzureAD/microsoft-authentication-library-for-js/blob/dev/samples/msal-node-samples/auth-code-pkce/src/index.ts#L115.

I also printed 'tokenRequest' content before calling 'acquireTokenByCode' and it's ok, so the request payload if valid.

const tokenRequest: AuthorizationCodeRequest = {
  code: req.query.code as string,
  scopes: ["user.read"],
  redirectUri: "
  codeVerifier: req.session.pkceCodes.verifier, // PKCE Code Verifier
  clientInfo: req.query.client_info as string,
};

const tokenResponse = await pca.acquireTokenByCode(tokenRequest);

The same piece of code is working fine outside the docker container.

This is the log from docker desktop (omitting useless parts and hiding private info like clientId, tenantId and clientSecret):

2026-02-19 12:04:44.548 | msalConfig:  {
2026-02-19 12:04:44.548 |   auth: {
2026-02-19 12:04:44.548 |     clientId: 'MY_CLIENT_ID',
2026-02-19 12:04:44.548 |     authority: 'https://login.microsoftonline.com/MY_TENANT_ID',
2026-02-19 12:04:44.548 |     clientSecret: 'MY_SECRET_ID'
2026-02-19 12:04:44.548 |   },
2026-02-19 12:04:44.548 |   system: {
2026-02-19 12:04:44.548 |     loggerOptions: {
2026-02-19 12:04:44.548 |       loggerCallback: [Function: loggerCallback],
2026-02-19 12:04:44.548 |       piiLoggingEnabled: false,
2026-02-19 12:04:44.548 |       logLevel: 4
2026-02-19 12:04:44.548 |     }
2026-02-19 12:04:44.548 |   }
2026-02-19 12:04:44.548 | }
2026-02-19 12:04:44.559 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Info - getAuthCodeUrl called
2026-02-19 12:04:44.559 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - initializeRequestScopes called
2026-02-19 12:04:44.559 | [Thu, 19 Feb 2026 11:04:44 GMT] : [8613e73d-57cc-4372-8db8-cf65bf6d8fb3] : @azure/msal-node@3.8.7 : Verbose - createAuthority called
2026-02-19 12:04:44.560 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityResolveEndpointsAsync
2026-02-19 12:04:44.560 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Retrieving all cache keys
2026-02-19 12:04:44.560 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:44.560 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityUpdateCloudDiscoveryMetadata
2026-02-19 12:04:44.560 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Attempting to get cloud discovery metadata  from authority configuration
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Found cloud discovery metadata from hardcoded values.
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityUpdateCloudDiscoveryMetadata
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityUpdateEndpointMetadata
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Attempting to get endpoint metadata from authority configuration
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityUpdateEndpointMetadata
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:44.561 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Setting cache key value store
2026-02-19 12:04:44.562 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityResolveEndpointsAsync
2026-02-19 12:04:44.562 | [Thu, 19 Feb 2026 11:04:44 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Replacing tenant domain name MY_TENANT_ID with id {tenantid}

(...)

2026-02-19 12:04:44.562 | authCodeUrlResponse = https://login.microsoftonline.com/MY_TENANT_ID/oauth2/v2.0/authorize?client_id=MY_CLIENT_ID&scope=user.read%20openid%20profile%20offline_access&redirect_uri=http%3A%2F%2Flocalhost%3A4200%2Fapi%2Fauth%2Ftoken%2Fredirect&client-request-id=8613e73d-57cc-4372-8db8-cf65bf6d8fb3&response_mode=query&client_info=1&x-client-SKU=msal.js.node&x-client-VER=3.8.7&x-client-OS=linux&x-client-CPU=x64&response_type=code&code_challenge=DGAbWa2YpHZX4U8CnB7IDkSNLihA5OXcTSZQ0GjXJxk&code_challenge_method=S256


------------------------------------------------

HERE THE REDIRECT/CALLBACK API IS CALLED

------------------------------------------------


2026-02-19 12:04:45.580 | tokenRequest  {
2026-02-19 12:04:45.580 |   code: '1.ARMBs9M3OYypnEK5IVkwqca9aEAPJgsuL0ZHp1syC60a0XUAAAATAQ.BQABBAIAAAADAOz_BQD0_0V2b1N0c0FydGlmYWN0cwIAAAAAAI8PD3tMKkSQOOjKoLIWfcjdTK1ioBF73AVA2czr4h5iSY8TBs4zvN-IPg1PNgpm2RewJS1Oe0IBvc2UyqeFrn7t-ZihWa3_z18xt6ROFjcKl89yxurvE3x7sr_b1Nk5CtimObtBx0Y-qYRYIqAeDcjUMSRTSOBFe12mNKKn6P2NG8xGxOi20OeV5kSfQj8RH96yk8S5gK72tx7Rw0x5bskt-JAQCd9678qa2xWfIzaTlmwkxW7uw-Tn-uJcwN4ipwfm0QcW6SJZjUNrtroG5sWkoYwuipQpAGaaf4zbY1wNyYaeZjOx6GNSL9O2gy38e_n7kmB1jhC1Ldj9Wjk-sDXzhF95y3nB2lqZgt1uX0JsGPOm6qH3GUdSUUDdNPHB4YwRdC5XAlYXrH4OiKO4CNhnJ1Sy0nFqdx9Pv8HidT3t_C9V9nN8IjvQe_QEeIeQztK4rglanUrSTskNjh4DRZzWXX7m2pojd1nIU-NlpdED3XL86SRegIav_PNwYjof33jbdlQGS6rSnFGKQZoTqXG3ANlsEn3EdoT-ilpST9614dvCD0DFZu4LHEmZROlBw3Y0YV6W4VZ8xsvs2iPb67lkhtx9Ir7c7tUfVjwsXvSRlqZrHddSD07E9nhhoR7L90poDXOO1FAJbEHcZj3_U88gFdQoWOJsRpjcb_b2oTbXuorT9TDPKRd_RiFaZUR5tHRJY7qowXEkDFZEA83uVGAgPu1ugV4jGkjXwj-7nXFQT9t9bguFrQs-KqD5uUqfHNxXpF35Z9iQLJSMhP3SyLDE-db3jVhZSVQz9SndS8mvG3YWXfc-5qTQRmSg-GJCokLiDFs6uTX6nwQ81YdU8wRvqnZeCr5Yw2LFLFylv_TbGfF2SE3fp75x0sF2J-1kAaPkLIfjUirQNC7p47HGfIwdZhAZjWdyuhNZyC0Pwsf0WFtShN33jPICoYj7hMXm4mG7o-ioJqNFbw8a96P1s9TtkOx82lJ3sqG8oMj-n64rayeZS4j5sWf7dOls-aKgb-AibA0e6yF3cDDWjfoSqne2qQtg-D_RPuQGWYjmXI2JZtctBLwLbcRFESWhgTeFygzPdt5Pnes7oQtDqxZr0K1dBg0NLIKle-ZvpNMfnkDIAx5-NkQlbPzgeNioy5xf1cU2s5SYKJcaPoGLpn0XRZw96W9NU-MKPSwF2MI6jFBAHBjOGpQPnIpzi2Q_6P0_jL6W31SaTGI3HLH8uD9OSBAlr8eNIypvb7kuVluyjjjr2UPYDUSlTNl8GWD4r_io9FUx6M65Qn2GytUciP5BGyyDh7jKxJWAvUNjiDFxvhLpDycwbdbbZ7LuSU44jNxpz7aAAhw-_up9yThTkQ59UTU3gpoWFFLocTV1vbFNTBDqFgBHrC4yiNuH7CytTbN_yqNAL9131F0SPSYnJudd6h4tw7GxRphb0vcbRdmFD_BdnbcP21XDOvE-n-LOol2b5y3w1S5ph1OEzG-n2v1W4GgmOBn5TuHYBt2rrpSdugO8eWVbWaVekFJl-2GBL6Kh5st4DN3ZaTDArZQnSz6aQX2ElyBVhjwAFGHYVJJNQW3EG2ZHpyBmiL7zTOfV3qPCx1R1Q8wHfQbu6Iun6YCqhEaCiBI5BGuqMe4OqsRPQ7JldfyEtEddLzqtHgJo9IeEYJGTTotH-PIZZDRppIFNR6HzOYARk7PiazFhEdjUC3bWpci5-DCO1P71bxB9HjpeivNTuXjXiXe1nGkDQ72ZZcCtH3dgj8XBsuICB8ynXtQ5f12fBHb8D9mpTo5WlU1OMvrnpfDKkOLbXgMYWfq-MDV1U4Dz2L777L86AbCkmht2EWvd6VI0hG70Cy_qLW7vv0qAaYZK5hF1SVi_FhsjnhD2kNXFlUyXuGypdmozle3JejPMemyP6HIKgeOQEPgCcX7ztvladtFdhv-YDBSPTx9jfd7xBYpHOriaiDOEfP0E5qN1RzTdSHqMc4DF8NfGXflRAGNhypYuDSW_P9_QaDgqvUjtloAUq3gki4NSltVpP60jAFMn0xs6pJrI_GwFYGp2fildoeblqnREcxt0XkHx4-NlX63svW58KcEy',
2026-02-19 12:04:45.580 |   scopes: [ 'user.read' ],
2026-02-19 12:04:45.580 |   redirectUri: 'http://localhost:4200/api/auth/token/redirect',
2026-02-19 12:04:45.580 |   codeVerifier: 'eUE3fkhubDVfZnlwWkc2NkNWZ01LTTMwcnpaZjJGVVFZ',
2026-02-19 12:04:45.580 |   clientInfo: 'eyJ1aWQiOiIwMDAwMDAwMC0wMDAwLTAwMDAtMjdhMC02MzA0NzYxZGFmZGUiLCJ1dGlkIjoiOTE4ODA0MGQtNmM2Ny00YzViLWIxMTItMzZhMzA0YjY2ZGFkIn0'
2026-02-19 12:04:45.580 | }
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Info - acquireTokenByCode called
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - initializeRequestScopes called
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-node@3.8.7 : Verbose - createAuthority called
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityResolveEndpointsAsync
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Retrieving all cache keys
2026-02-19 12:04:45.580 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityUpdateCloudDiscoveryMetadata
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Attempting to get cloud discovery metadata  from authority configuration
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Did not find cloud discovery metadata in the config... Attempting to get cloud discovery metadata from the hardcoded values.
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Found cloud discovery metadata from hardcoded values.
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityUpdateCloudDiscoveryMetadata
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Executing function authorityUpdateEndpointMetadata
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Attempting to get endpoint metadata from authority configuration
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Did not find endpoint metadata in the config... Attempting to get endpoint metadata from the hardcoded values.
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityUpdateEndpointMetadata
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Setting cache key value store
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Returning result from authorityResolveEndpointsAsync
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-node@3.8.7 : Verbose - buildOauthClientConfiguration called
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Replacing tenant domain name MY_TENANT_ID with id {tenantid}
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-node@3.8.7 : Info - Building oauth client configuration with the following authority: https://login.microsoftonline.com/MY_TENANT_ID/oauth2/v2.0/token.
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-node@3.8.7 : Verbose - Auth code client created
2026-02-19 12:04:45.581 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Executing function authClientExecuteTokenRequest
2026-02-19 12:04:45.582 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Verbose - Replacing tenant domain name MY_TENANT_ID with id {tenantid}
2026-02-19 12:04:45.582 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Executing function authClientCreateTokenRequestBody
2026-02-19 12:04:45.582 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.582 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.582 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Returning result from authClientCreateTokenRequestBody
2026-02-19 12:04:45.583 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Executing function authorizationCodeClientExecutePostToTokenEndpoint
2026-02-19 12:04:45.583 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.583 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Executing function networkClientSendPostRequestAsync
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Error occurred in networkClientSendPostRequestAsync
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - {}
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Error occurred in authorizationCodeClientExecutePostToTokenEndpoint
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - {"errorCode":"network_error","errorMessage":"Network request failed","subError":"","name":"ClientAuthError"}
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - Error occurred in authClientExecuteTokenRequest
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [3a36c1ce-ae57-45e5-a327-63eaaba97a7f] : @azure/msal-common@15.14.2 : Trace - {"errorCode":"network_error","errorMessage":"Network request failed","subError":"","name":"ClientAuthError"}
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Getting cache key-value store
2026-02-19 12:04:45.663 | [Thu, 19 Feb 2026 11:04:45 GMT] : [] : @azure/msal-node@3.8.7 : Trace - Setting cache key value store
2026-02-19 12:04:45.667 | ClientAuthError: network_error: Network request failed
2026-02-19 12:04:45.667 |     at createClientAuthError (/app/dist/node_modules/@azure/msal-node/lib/msal-node.cjs:856:12)
2026-02-19 12:04:45.667 |     at AuthorizationCodeClient.sendPostRequest (/app/dist/node_modules/@azure/msal-node/lib/msal-node.cjs:6253:23)
2026-02-19 12:04:45.667 |     at process.processTicksAndRejections (node:internal/process/task_queues:103:5)
2026-02-19 12:04:45.667 |     at async AuthorizationCodeClient.executePostToTokenEndpoint (/app/dist/node_modules/@azure/msal-node/lib/msal-node.cjs:6204:26)
2026-02-19 12:04:45.667 |     at async AuthorizationCodeClient.acquireToken (/app/dist/node_modules/@azure/msal-node/lib/msal-node.cjs:6973:26)
2026-02-19 12:04:45.667 |     at async ConfidentialClientApplication.acquireTokenByCode (/app/dist/node_modules/@azure/msal-node/lib/msal-node.cjs:10246:20)
2026-02-19 12:04:45.667 |     at async /app/dist/services/auth_api/src/services/auth-checker.js:83:31
Microsoft Security | Microsoft Entra | Microsoft Entra ID

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.