cosmos: handle HTTP 403/sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED) by refreshing bearer token and retrying by Copilot · Pull Request #46167 · Azure/azure-sdk-for-python

Copilot · 2026-04-06T21:14:03Z

Analyze issue: AsyncCosmosBearerTokenCredentialPolicy does not handle HTTP 403 with sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED) - only 401 is handled
Add send() override to AsyncCosmosBearerTokenCredentialPolicy in _auth_policy_async.py to clear cached token and retry on 403/5300
Add send() override to sync CosmosBearerTokenCredentialPolicy in _auth_policy.py for the same fix
Rewrite tests using realistic Pipeline/AsyncPipeline with MockTransport that returns proper requests.Response objects with headers
Tests verify Authorization header format (type=aad&ver=1.0&sig=<token>) in both initial and retry requests
Fix spelling: "retriable" → "retryable" in test docstrings
Update CHANGELOG.md with bug fix entry referencing PR 46167
Fix TypeError in test_aad_credentials: store retry flag in request.context (dict) instead of request.context.options (forwarded to transport as kwargs)
14 tests passing (7 sync + 7 async)

…and async) When Cosmos DB returns HTTP 403 with sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED), the cached bearer token is now cleared and the request is retried with a fresh token. This mirrors how the base class handles HTTP 401, and resolves the issue where long-running services using managed identity would permanently fail after token expiry. - Added send() override to CosmosBearerTokenCredentialPolicy (_auth_policy.py) - Added send() override to AsyncCosmosBearerTokenCredentialPolicy (_auth_policy_async.py) - Added unit tests for both sync and async policies Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/a5381531-6292-4e5e-be43-586d3267d980 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/a5381531-6292-4e5e-be43-586d3267d980 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

sdk/cosmos/azure-cosmos/tests/test_auth_policy_unit_async.py

Replace MagicMock-based policy isolation tests with full azure-core Pipeline/AsyncPipeline tests that use a real MockTransport (extending HttpTransport/AsyncHttpTransport). This approach: - Returns proper requests.Response objects with real header dicts, including x-ms-substatus for the 403/5300 trigger - Records all outgoing requests so tests can assert on the exact Authorization header value (type=aad&ver=1.0&sig=<token>) - Verifies both the Cosmos AAD header format and token freshness end-to-end through the full policy pipeline, matching the pattern used in azure-core's own authentication tests Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/a67aa68c-a3b6-42ef-824f-aa45415226d6 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot · 2026-04-06T23:10:03Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/6a43abe4-336d-48bb-9181-24523f9dc925 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot · 2026-04-07T04:43:04Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

bambriz · 2026-04-07T17:20:50Z

@copilot update changelog to mention the pr and the fix applied.

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/50ccc6e6-b671-434d-97cc-9469276b13da Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot · 2026-04-07T17:23:47Z

@copilot update changelog to mention the pr and the fix applied.

Done in commit f2daec1e — added a bug fix entry to the 4.16.0b3 (Unreleased) section of CHANGELOG.md referencing PR 46167.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Copilot

Pull request overview

This PR updates the Cosmos AAD bearer token auth policies to recover from a Cosmos-specific auth failure pattern (HTTP 403 with sub-status 5300 / AAD_REQUEST_NOT_AUTHORIZED) by clearing the cached token and retrying once, and adds unit coverage for both sync and async pipelines.

Changes:

Add 403/5300 detection in both sync and async Cosmos bearer token credential policies to refresh token and retry once.
Add new sync/async unit tests using Pipeline/AsyncPipeline with mock transports to validate retry behavior and Authorization header formatting.
Add a changelog entry documenting the bug fix.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
sdk/cosmos/azure-cosmos/azure/cosmos/_auth_policy.py	Adds sync `send()` override to retry once on 403 + substatus 5300 after clearing cached token.
sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py	Adds async `send()` override with the same 403/5300 retry behavior.
sdk/cosmos/azure-cosmos/tests/test_auth_policy_unit.py	New sync unit tests verifying retry and Cosmos AAD Authorization header format.
sdk/cosmos/azure-cosmos/tests/test_auth_policy_unit_async.py	New async unit tests verifying retry and Cosmos AAD Authorization header format.
sdk/cosmos/azure-cosmos/CHANGELOG.md	Documents the 403/5300 retry fix under Bugs Fixed.

sdk/cosmos/azure-cosmos/azure/cosmos/_auth_policy.py

sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

bambriz · 2026-04-10T20:11:19Z

sdk/cosmos/azure-cosmos/azure/cosmos/_auth_policy.py

+        :return: The pipeline response object
+        :rtype: ~azure.core.pipeline.PipelineResponse
+        """
+        retry_key = "_cosmos_aad_403_retried"


@copilot What is the point of this retry_key? It is causing a TypeError: Session.request() got an unexpected keyword argument '_cosmos_aad_403_retried'
in test_aad_credentials

Causing tests to fail.

Fixed in commit 36cd3987. The retry_key was being stored in request.context.options, which azure-core forwards as keyword arguments to the underlying Session.request() call — causing the TypeError. The flag is now stored directly in request.context (the PipelineContext dict), which is designed for pipeline-level metadata and is never forwarded to the transport.

…ntext.options Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/03081b79-9c5f-4572-b475-45d1ba581109 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot · 2026-04-10T20:15:50Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

pypi.org
- Triggering command: /home/REDACTED/work/azure-sdk-for-python/azure-sdk-for-python/.venv/bin/python /home/REDACTED/work/azure-sdk-for-python/azure-sdk-for-python/.venv/bin/python /home/REDACTED/work/azure-sdk-for-python/azure-sdk-for-python/.venv/lib/python3.9/site-packages/pip/__pip-REDACTED__.py install --ignore-installed --no-user --prefix /tmp/pip-build-env-qqyjlx6_/overlay --no-warn-script-location --no-binary :none: --only-binary :none: -i REDACTED -- setuptools>=40.8.0 (dns block)
scanning-api.github.com
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Initial plan

32b88c1

Copilot AI assigned Copilot and bambriz Apr 6, 2026

Copilot AI linked an issue Apr 6, 2026 that may be closed by this pull request

azure-cosmos: async client does not recover from 403 on expired AAD token (bearer token policy only handles 401) #45886

Open

Copilot started work on behalf of bambriz April 6, 2026 21:14 View session

bambriz and others added 3 commits April 6, 2026 14:16

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

58c0cbf

Fix condition indentation in send() overrides

de53008

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/a5381531-6292-4e5e-be43-586d3267d980 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix azure.cosmos client recovery from 403 on expired AAD token~~ cosmos: handle HTTP 403/sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED) by refreshing bearer token and retrying Apr 6, 2026

Copilot AI requested a review from bambriz April 6, 2026 21:24

Copilot finished work on behalf of bambriz April 6, 2026 21:24

bambriz reviewed Apr 6, 2026

View reviewed changes

sdk/cosmos/azure-cosmos/tests/test_auth_policy_unit_async.py Outdated Show resolved Hide resolved

Copilot started work on behalf of bambriz April 6, 2026 23:01 View session

bambriz and others added 2 commits April 6, 2026 16:02

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

8ef88db

Copilot finished work on behalf of bambriz April 6, 2026 23:10

Copilot AI requested a review from bambriz April 6, 2026 23:10

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

5ea1653

bambriz reviewed Apr 7, 2026

View reviewed changes

sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py Show resolved Hide resolved

Copilot started work on behalf of bambriz April 7, 2026 04:40 View session

Fix spelling: retriable -> retryable in test docstrings

a095d2c

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/6a43abe4-336d-48bb-9181-24523f9dc925 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot AI requested a review from bambriz April 7, 2026 04:43

Copilot finished work on behalf of bambriz April 7, 2026 04:43

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

0277df9

Copilot started work on behalf of bambriz April 7, 2026 17:21 View session

Update CHANGELOG with bug fix for HTTP 403/5300 AAD token refresh

f2daec1

Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/50ccc6e6-b671-434d-97cc-9469276b13da Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot finished work on behalf of bambriz April 7, 2026 17:24

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

35c6bc6

simorenoh marked this pull request as ready for review April 9, 2026 19:04

simorenoh requested a review from a team as a code owner April 9, 2026 19:04

Copilot AI review requested due to automatic review settings April 9, 2026 19:04

Copilot AI reviewed Apr 9, 2026

View reviewed changes

sdk/cosmos/azure-cosmos/azure/cosmos/_auth_policy.py Outdated Show resolved Hide resolved

sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py Outdated Show resolved Hide resolved

simorenoh and others added 2 commits April 10, 2026 14:43

Update sdk/cosmos/azure-cosmos/azure/cosmos/aio/_auth_policy_async.py

39b167b

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Update sdk/cosmos/azure-cosmos/azure/cosmos/_auth_policy.py

157a59e

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

bambriz reviewed Apr 10, 2026

View reviewed changes

Copilot started work on behalf of bambriz April 10, 2026 20:11 View session

Fix retry_key TypeError: store 403-retry flag in context dict, not co…

36cd398

…ntext.options Agent-Logs-Url: https://github.com/Azure/azure-sdk-for-python/sessions/03081b79-9c5f-4572-b475-45d1ba581109 Co-authored-by: bambriz <8497145+bambriz@users.noreply.github.com>

Copilot AI requested a review from bambriz April 10, 2026 20:15

Copilot finished work on behalf of bambriz April 10, 2026 20:15

Merge branch 'main' into copilot/fix-azure-cosmos-403-error

fafb8e7

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cosmos: handle HTTP 403/sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED) by refreshing bearer token and retrying#46167

cosmos: handle HTTP 403/sub-status 5300 (AAD_REQUEST_NOT_AUTHORIZED) by refreshing bearer token and retrying#46167
Copilot wants to merge 15 commits intomainfrom
copilot/fix-azure-cosmos-403-error

Copilot AI commented Apr 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI commented Apr 6, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Copilot AI commented Apr 7, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

bambriz commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026 •

edited

Loading

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

bambriz Apr 10, 2026

Uh oh!

Copilot AI Apr 10, 2026

Uh oh!

Copilot AI commented Apr 10, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 6, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Copilot AI commented Apr 7, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

bambriz commented Apr 7, 2026

Uh oh!

Copilot AI commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

bambriz Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 10, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Apr 10, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Apr 6, 2026 •

edited

Loading

Copilot AI commented Apr 7, 2026 •

edited

Loading