{Core} Handle JSONDecodeError for corrupted MSAL token cache and SP entries by Copilot · Pull Request #33728 · Azure/azure-cli

Copilot · 2026-07-15T01:18:22Z

Related command
az login

Description

az login crashes with json.decoder.JSONDecodeError: Extra data when ~/.azure/msal_token_cache.json is corrupted (e.g., partial/concurrent writes). The msal_extensions.PersistedTokenCache._reload_if_necessary() only catches PersistenceNotFound, letting JSONDecodeError propagate unhandled.

Changes:

AzureCliTokenCache (persistence.py): New subclass of PersistedTokenCache that overrides _reload_if_necessary to catch json.JSONDecodeError, emit a warning, and reset the in-memory cache to empty via self.deserialize(None). The subsequent modify() call then writes a fresh valid cache to disk, overwriting the corrupt file.
load_persisted_token_cache: Updated to return AzureCliTokenCache instead of bare PersistedTokenCache.
SecretStore.load: Also catches json.JSONDecodeError for the service principal entries file, returning [] rather than raising.

Testing Guide

Manually corrupt ~/.azure/msal_token_cache.json by appending extra bytes, then run az login:

echo "corrupted" >> ~/.azure/msal_token_cache.json
az login

Before this fix: crashes with JSONDecodeError: Extra data.
After this fix: logs a warning and proceeds with a fresh cache.

Unit tests added in src/azure-cli-core/azure/cli/core/auth/tests/test_persistence.py covering corrupted and valid JSON for both AzureCliTokenCache and SecretStore.

History Notes

[Core] az login: Fix JSONDecodeError crash when MSAL token cache file is corrupted

This checklist is used to make sure that common guidelines for a pull request are followed.

The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.
I adhere to the Error Handling Guidelines.

azure-client-tools-bot-prd · 2026-07-15T01:18:25Z

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

azure-client-tools-bot-prd · 2026-07-15T01:18:28Z

Validation for Breaking Change Starting...

Thanks for your contribution!

azure-pipelines · 2026-07-15T01:18:31Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

…ntries

…nce creation

x-engineering-agent · 2026-07-15T01:27:12Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

Posted by agent-assist (autonomous bug-fix pipeline).

x-engineering-agent

Automated Review Summary

PR: {Core} Handle JSONDecodeError for corrupted MSAL token cache and SP entries

Live test: Skipped (neutral) — this PR only changes azure-cli-core unit tests, which are not runnable via azdev test --live. No other test files were changed.
CI checks: All 1/1 checks passed, none pending, none failed.

No blocking issues found. This PR appears ready based on the CI status observed at this head commit (027cbcc).

Posted by agent-assist (autonomous bug-fix pipeline).

Yong Zhang (yonzhan) · 2026-07-15T03:12:56Z

Core

azure-pipelines · 2026-08-04T02:29:03Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Adds resilience to auth persistence by tolerating corrupted JSON files and introduces tests to validate the behavior.

Changes:

Introduced AzureCliTokenCache to swallow JSONDecodeError during cache reload and reset in-memory state.
Updated persisted token cache loading to return AzureCliTokenCache.
Added unit tests covering corrupted/valid JSON for both token cache and secret store.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
src/azure-cli-core/azure/cli/core/auth/persistence.py	Adds JSON corruption handling for token cache reload and secret store load.
src/azure-cli-core/azure/cli/core/auth/tests/test_persistence.py	Adds regression tests ensuring corrupted JSON does not crash token cache/secret store loads.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+    def _reload_if_necessary(self):
+        try:
+            super()._reload_if_necessary()
+        except json.JSONDecodeError as ex:
+            # The token cache file may be corrupted due to incomplete or concurrent writes.
+            # Reset to a fresh empty cache so that the current operation can continue.
+            logger.warning("Failed to deserialize token cache '%s': %s. "
+                           "The cache will be reset.", self._persistence.get_location(), ex)
+            self.deserialize(None)


+            logger.warning("Failed to deserialize token cache '%s': %s. "
+                           "The cache will be reset.", self._persistence.get_location(), ex)
+            self.deserialize(None)


+            logger.warning("Failed to deserialize service principal entries '%s': %s. "
+                           "The entries will be reset.", self._persistence.get_location(), ex)
+            return []


+    def _make_persistence(self, tmp_path):
+        """Build a FilePersistence from a .json tmp file path."""
+        # build_persistence appends the .json extension, so strip it first
+        return build_persistence(tmp_path.replace('.json', ''), encrypt=False)


+
+            # Use float('inf') so that the condition `_last_sync < time_last_modified()` is
+            # always True, forcing a reload on every call to _reload_if_necessary.
+            with mock.patch.object(type(cache._persistence), 'time_last_modified', return_value=float('inf')):


Aditya Pujara (a0x1ab) · 2026-08-04T04:50:57Z

Copilot please review and implement all unaddressed human feedback through Yong Zhang (@yonzhan)'s latest comment at #33728 (comment), then push the fix to this PR.

Posted by agent-assist (autonomous bug-fix pipeline).

Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>

x-engineering-agent · 2026-08-04T06:26:36Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

Posted by agent-assist (autonomous bug-fix pipeline).

x-engineering-agent

❌ CI Failures Detected

This PR has 2 failing checks out of 90 total (0 pending):

Azure.azure-cli — Build #20260804.12 failed. See: https://github.com/Azure/azure-cli/runs/91943884389
Azure.azure-cli (Test Homebrew Formula) — Test Homebrew Formula failed. See: https://github.com/Azure/azure-cli/runs/91902064118

Please investigate and fix the underlying cause of these failures, then push an update to this PR.

x-engineering-agent · 2026-08-19T14:33:25Z

Started a Copilot task using claude-sonnet-4.6 for the automated review at #33728 (review): https://github.com/Azure/azure-cli/tasks/fc838b02-16bf-4b64-9f30-130378849065

…_modified Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>

x-engineering-agent · 2026-08-19T14:57:26Z

Live test skipped

⏭️ Skipping the live test for this revision because the only test file(s) changed are azure-cli-core unit tests, which the live-test pipeline (azdev test --live) does not run — it covers command-module and extension tests only.

These azure-cli-core tests are exercised by upstream CI's unit-test jobs instead. This is informational; no action is required.

microsoft-github-policy-service · 2026-09-02T04:18:38Z

🔔 Routing this PR to @Azure/act-identity-squad.

Initial plan

e2cf5e7

Copilot AI assigned Copilot and Aditya Pujara (a0x1ab) Jul 15, 2026

azure-client-tools-bot-prd Bot added this to the August 2026 (2026-08-04) milestone Jul 15, 2026

Copilot AI linked an issue Jul 15, 2026 that may be closed by this pull request

az login error after authentication in browser - json.decoder.JSONDecodeError: Extra data: line 3 column 8 (char 31) #33720

Open

Copilot started work on behalf of Aditya Pujara (a0x1ab) July 15, 2026 01:18 View session

microsoft-github-policy-service Bot requested a review from Yong Zhang (yonzhan) July 15, 2026 01:18

microsoft-github-policy-service Bot added Auto-Assign Auto assign by bot Account az login/account act-identity-squad labels Jul 15, 2026

Copilot AI added 2 commits July 15, 2026 01:24

{Core} Handle JSONDecodeError for corrupted MSAL token cache and SP e…

9761f0a

…ntries

{Core} Refactor test_persistence.py to use helper method for persiste…

027cbcc

…nce creation

Copilot AI changed the title ~~[WIP] Fix az login error after authentication in browser~~ {Core} Handle JSONDecodeError for corrupted MSAL token cache and SP entries Jul 15, 2026

Copilot finished work on behalf of Aditya Pujara (a0x1ab) July 15, 2026 01:26

Copilot AI requested a review from Aditya Pujara (a0x1ab) July 15, 2026 01:26

x-engineering-agent Bot reviewed Jul 15, 2026

View reviewed changes

x-engineering-agent Bot marked this pull request as ready for review August 4, 2026 02:28

x-engineering-agent Bot requested a review from a team as a code owner August 4, 2026 02:28

Copilot AI review requested due to automatic review settings August 4, 2026 02:28

Copilot AI reviewed Aug 4, 2026

View reviewed changes

Copilot started work on behalf of Aditya Pujara (a0x1ab) August 4, 2026 04:51 View session

Address review feedback on token cache/SP entry JSON error handling

79f202c

Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>

Copilot finished work on behalf of Aditya Pujara (a0x1ab) August 4, 2026 04:55

Aditya Pujara (a0x1ab) added agent-assist and removed agent-assist labels Aug 6, 2026

x-engineering-agent Bot reviewed Aug 19, 2026

View reviewed changes

Copilot started work on behalf of Aditya Pujara (a0x1ab) August 19, 2026 14:34 View session

Simplify test_persistence.py: remove unnecessary mocking of time_last…

b9f8eb6

…_modified Co-authored-by: a0x1ab <59631311+a0x1ab@users.noreply.github.com>

Copilot finished work on behalf of Aditya Pujara (a0x1ab) August 19, 2026 14:54

Aditya Pujara (a0x1ab) added X Engineering Agent Reviewed Pull request reviewed by X Engineering Agent and removed azure-client-tools-agent labels Sep 2, 2026

Uh oh!

Conversation

Copilot AI commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 15, 2026

Uh oh!

azure-client-tools-bot-prd Bot commented Jul 15, 2026

Uh oh!

azure-pipelines Bot commented Jul 15, 2026

Uh oh!

x-engineering-agent Bot commented Jul 15, 2026

Live test skipped

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

Automated Review Summary

Uh oh!

Yong Zhang (yonzhan) commented Jul 15, 2026

Uh oh!

azure-pipelines Bot commented Aug 4, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Aditya Pujara (a0x1ab) commented Aug 4, 2026

Uh oh!

x-engineering-agent Bot commented Aug 4, 2026

Live test skipped

Uh oh!

x-engineering-agent Bot left a comment

Choose a reason for hiding this comment

❌ CI Failures Detected

Uh oh!

x-engineering-agent Bot commented Aug 19, 2026

Uh oh!

x-engineering-agent Bot commented Aug 19, 2026

Live test skipped

Uh oh!

microsoft-github-policy-service Bot commented Sep 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 15, 2026 •

edited

Loading