Describe the bug
az network bastion ssh, az network bastion tunnel, and any other bastion extension command that establishes a WebSocket tunnel fails immediately with Exception in handling client: Invalid WebSocket Header on Windows installations of Azure CLI 2.76 and later.
The HTTP POST to /api/tokens on the Bastion host succeeds (returns 200), but the subsequent WebSocket upgrade handshake is rejected internally. The tunnel terminates before any data can be forwarded. az network bastion rdp (which downloads an .rdp file without using WebSocket tunneling) works correctly, confirming the issue is specific to the tunnel code path.
To reproduce:
On a Windows 11 machine with Azure CLI installed via MSI (2.76.0 through 2.85.0 — any version bundling Python 3.13):
Related command
az network bastion ssh --name "" --resource-group "" --target-resource-id "" --auth-type "AAD" --debug
Also happens with "ssh-key" authorization type
Errors
cli.azext_bastion.tunnel: Exception in handling client: Invalid WebSocket Header
cli.azext_bastion.tunnel: Cleaning up session
Issue script & Debug output
urllib3.connectionpool: https://bst-.bastion.azure.com:443 "POST /api/tokens HTTP/1.1" 200 None
cli.azext_bastion.tunnel: Exception in handling client: Invalid WebSocket Header
cli.azext_bastion.tunnel: Cleaning up session
urllib3.connectionpool: https://bst-.bastion.azure.com:443 "DELETE /api/tokens/ HTTP/1.1" 204 0
Expected behavior
The SSH session should open through the Bastion tunnel.
Environment Summary
OS: Windows 11 (26200)
Azure CLI: 2.76.0, 2.84.0, 2.85.0 (MSI install) — all fail
Python (bundled): 3.13.x
bastion extension: 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3 — all fail
ssh extension: 2.0.7
az version
{
"azure-cli": "2.85.0",
"azure-cli-core": "2.85.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"bastion": "1.4.3",
"ssh": "2.0.7"
}
}
Additional context
This a Linux VM running Ubuntu 24.04 pro. I have tried this on multiple computers and getting the same error. Oddly, the ability to ssh into the vm from my local terminal was working for me the first few days after I first setup this VM. After another user started accessing the VM is when it seems like it stopped working. I have also tried with another bastion instance on a Windows VM that we have in a different subscription, and I am getting the same error there as well (Invalid WebSocket Header), but I am still able to RDP into that Windows VM through my native client. I am also still able to access the Linux VM through Bastion in the Azure portal via ssh-key and Entra authorization.
Describe the bug
az network bastion ssh, az network bastion tunnel, and any other bastion extension command that establishes a WebSocket tunnel fails immediately with Exception in handling client: Invalid WebSocket Header on Windows installations of Azure CLI 2.76 and later.
The HTTP POST to /api/tokens on the Bastion host succeeds (returns 200), but the subsequent WebSocket upgrade handshake is rejected internally. The tunnel terminates before any data can be forwarded. az network bastion rdp (which downloads an .rdp file without using WebSocket tunneling) works correctly, confirming the issue is specific to the tunnel code path.
To reproduce:
On a Windows 11 machine with Azure CLI installed via MSI (2.76.0 through 2.85.0 — any version bundling Python 3.13):
Related command
az network bastion ssh --name "" --resource-group "" --target-resource-id "" --auth-type "AAD" --debug
Also happens with "ssh-key" authorization type
Errors
cli.azext_bastion.tunnel: Exception in handling client: Invalid WebSocket Header
cli.azext_bastion.tunnel: Cleaning up session
Issue script & Debug output
urllib3.connectionpool: https://bst-.bastion.azure.com:443 "POST /api/tokens HTTP/1.1" 200 None
cli.azext_bastion.tunnel: Exception in handling client: Invalid WebSocket Header
cli.azext_bastion.tunnel: Cleaning up session
urllib3.connectionpool: https://bst-.bastion.azure.com:443 "DELETE /api/tokens/ HTTP/1.1" 204 0
Expected behavior
The SSH session should open through the Bastion tunnel.
Environment Summary
OS: Windows 11 (26200)
Azure CLI: 2.76.0, 2.84.0, 2.85.0 (MSI install) — all fail
Python (bundled): 3.13.x
bastion extension: 1.3.0, 1.4.0, 1.4.1, 1.4.2, 1.4.3 — all fail
ssh extension: 2.0.7
az version
{
"azure-cli": "2.85.0",
"azure-cli-core": "2.85.0",
"azure-cli-telemetry": "1.1.0",
"extensions": {
"bastion": "1.4.3",
"ssh": "2.0.7"
}
}
Additional context
This a Linux VM running Ubuntu 24.04 pro. I have tried this on multiple computers and getting the same error. Oddly, the ability to ssh into the vm from my local terminal was working for me the first few days after I first setup this VM. After another user started accessing the VM is when it seems like it stopped working. I have also tried with another bastion instance on a Windows VM that we have in a different subscription, and I am getting the same error there as well (Invalid WebSocket Header), but I am still able to RDP into that Windows VM through my native client. I am also still able to access the Linux VM through Bastion in the Azure portal via ssh-key and Entra authorization.