[Bug]: "MS SQL: Add Microsoft Entra Account" hangs on localhost callback and fails token redemption with ClientAuthError: network_error (macOS arm64, VS Code 1.109.5)

[Michael9094]

Description

Expected the MSSQL extension to successfully add my Microsoft Entra account after completing the interactive browser login flow, and then allow me to connect using Microsoft Entra ID – Universal with MFA support.

But what actually happened was: the browser completes sign-in and navigates to a localhost callback URL like http://127.0.0.1:/callback?code=... and then hangs "waiting for a response". In the MSSQL-Azure Auth logs, the extension calls acquireTokenByCode and then fails while posting to the token endpoint with:

ClientAuthError: network_error: Network request failed

Despite this, the logs sometimes show Account added successfully. but no usable account is added, and the flow never completes.

Steps to Reproduce

1. On macOS (Apple Silicon), open VS Code.
2. Install/enable SQL Server (mssql) extension.
3. Run command palette: MS SQL: Add Microsoft Entra Account.
4. A browser window opens to https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize.
5. Select an Entra account and complete sign-in.
6. Browser redirects to http://127.0.0.1:/callback?code=... and hangs indefinitely.
7. VS Code logs show acquireTokenByCode followed by network_error: Network request failed.

Affected Area

• Connection dialog (SQL Server | Azure browse/Fabric browse)
• Query editor
• Query results panel
• Object Explorer
• GitHub Copilot integration
• Preview/Edit data
• Table Designer
• Schema Designer
• Schema Compare
• Local SQL Server Container provisioning
• SQL database in Fabric provisioning
• DACPAC/BACPAC export/import
• SQL Database projects
• Query Plan Visualizer
• Other (please describe below)

If you selected "Other", please describe the affected area

No response

Environment Information

MSSQL Extension: Version 1.40.0
VS Code Version: 1.109.5 (Universal)
Commit: 072586267e68ece9a47aa43f8c108e0dcbf44622
Date: 2026-02-19T19:43:32.382Z
Electron: 39.3.0
ElectronBuildId: 13313481
Chromium: 142.0.7444.265
Node.js: 22.21.1
V8: 14.2.231.22-electron.0
OS: Darwin arm64 25.3.0
Connection Type: Azure SQL

Confirmation

• I have searched existing issues and couldn't find a match
• I want to work on this issue

[Michael9094]

Troubleshooting steps attempted

Environment / versions

• mssql extension initially reported 1.39.0; later reinstall showed 1.40.0 during SqlToolsService install attempt.

Auth/cache resets

• Ran MS SQL: Clear Microsoft Entra account token cache.

• Quit VS Code completely, deleted:

  • ~/Library/Application Support/Code/Azure Accounts

• Deleted mssql-related keys from VS Code global state DB state.vscdb:

  • ms-mssql.mssql
  • ms-mssql.mssql-microsoft-https://management.core.windows.net/.default
  • secret://{"extensionId":"ms-mssql.mssql","key":"Microsoft.SqlTools|profile_id:...|itemtype:Mru"}
  • secret://{"extensionId":"ms-mssql.mssql","key":"azureAccountProviderCredentials|accessTokenCache-iv"}
  • secret://{"extensionId":"ms-mssql.mssql","key":"azureAccountProviderCredentials|accessTokenCache-key"}

• Uninstalled the mssql extension and reinstalled it; restarted VS Code.

Network / connectivity verification

• Verified successful connectivity to the token endpoint with curl, including IPv6 and POST:

  • curl -6 -v -X POST https://login.microsoftonline.com/organizations/oauth2/v2.0/token (returns HTTP response, e.g. 411/400 depending on body)

• Verified Node can POST to the token endpoint from both:

  • macOS Terminal and VS Code integrated terminal (simple https request returns status 400).

• Verified Azure CLI auth works:

  • az login succeeded
  • az account get-access-token --resource https://database.windows.net/ succeeded

Browser/session variations

• Retried the sign-in flow in a Chrome Incognito window (same behavior).

Loopback listener verification

• Confirmed VS Code is listening on the localhost callback port during the hang:

  • lsof -nP -iTCP:<port> -sTCP:LISTEN shows Code Helper listening on 127.0.0.1:<port>.

Other observations

• During one reinstall/launch, the extension failed installing/loading SqlToolsService with:

  • Download attempted: https://github.com/Microsoft/sqltoolsservice/releases/download/5.0.20260212.1/...net8.0.tar.gz
  • Error: TypeError: Cannot read properties of undefined (reading 'call')
  • After uninstall/reinstall, the extension loaded again but the Entra login failure persisted.

---

Key log excerpt (representative)

• @azure/msal-node@2.12.0 : Info - acquireTokenByCode called
• authorizationCodeClientExecutePostToTokenEndpoint
• {"errorCode":"network_error","errorMessage":"Network request failed","name":"ClientAuthError"}
• Login failed: ClientAuthError: network_error: Network request failed
• sometimes followed by: Account added successfully. (but account is not actually added / flow does not complete)

[Benjin]

Thanks for all the debugging information! If you could answer a few more questions for me:

• Are you running under a VPN or Proxy?
• Is there anything unique or notable about your Entra account (a guest account, how you're authenticating, etc.)

Can you enable verbose logging by setting "mssql.tracingLevel": "Verbose", attempt to connect, then share the output in the MSSQL and MSSQL - Azure auth output panes? ⚠️ Make sure to scrub the logs of all personal information (subscription/tenant GUIDs, emails, server/database names) before sharing.

[Michael9094]

@Benjin, thanks for your help.

• I'm not running under a VPN or Proxy
• The User type on my Entra account is Member, not Guest
• The Authentication type is Microsoft Entra ID - Universal with MFA support

Attached are the two logs you requested.

mssql.txt

mssql-azure-auth-logs.txt

Let me know if there's anything else I can do to help.