400 Client Error in Azure Cloud Shell Connector

[TechWatching]

Environment

Windows build number: Microsoft Windows [version 10.0.18362.10005]
Windows Terminal version (if applicable): 0.3.2171.0

Steps to reproduce

1- Open a new CloudShell tab and log in
2- Execute some azure cli commands for about 10 min

Expected behavior

Azure CLI commands continue to execute without any problem

Actual behavior

After some time, the azure cli commands will failed with the following error :
Error occurred in request., HTTPError: 400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token

Executig several times the same commands (az keyvault secret show --vault-name $kvName -n $secretName --query id -o tsvfor instance) won't change anything. However the azure cloud shell is opened in the browser (shell.azure.com) the same command will work and executing azure cli commands will start working again in the azure cloud shell of windows terminal.

[TechWatching]

This error always appears when doing a command linked to azure AD like az ad user list . It works fine on shell.azure.com but not in WindowsTerminal.

[GillesZunino]

Giving this a +1 - Adding / retrieving secrets is a common operation when running deploying scripts and this issue makes it near impossible to use Cloud Shell Connector for anything serious.

• Using Terminal 0.7.3451.0 - Open a Cloud Shell Connector and connect to an active Azure subscription
• Make sure the subscription has a vault called "SecureSecretVault" and it contains a secret called "TheSecret"
• Run the following: az keyvault secret show --name "TheSecret" --vault-name "SecureSecretVault"

OBSERVE:
Error occurred in request., HTTPError: 400 Client Error: Bad Request for url: http://localhost:50342/oauth2/token

EXPECTED:
The secret value is displayed

[DHowett-MSFT]

Alright, finally figured this one out. It's a chunk of work to support it, but it looks like AZCs has a "control" channel that it can use to request additional authentication/do other exchanges with the thing that's hosting it (typically the cloud shell javascript.)
One of those requests is for "token". 😄

[bandwiches]

Do you propose any workarounds for #6038 besides the browser shell in the Azure Portal (which isn't really viable)? I'm unable to do anything remote since the session cannot be loaded. Thanks!

[wasker]

Hi,

Are there any plans to address this issue? Is there a documentation on the "control channel" one could use to contribute the fix?