Azure App Service Bitbucket OAuth callback returns 404 when authorization code exceeds 1024-byte query string limit

Gabor Ocsko 5 Reputation points
2026-08-28T06:39:37.9333333+00:00

We are unable to configure Bitbucket continuous deployment for an Azure App Service through Deployment Center.

Environment:

  • Azure App Service (Windows)
  • Deployment Center
  • Source: Bitbucket
  • Multiple Bitbucket users tested
  • Multiple App Services tested

Reproduction:

  1. Open App Service -> Deployment Center
  2. Select Bitbucket as source
  3. Click Authorize
  4. Atlassian authorization page opens correctly
  5. Click Accept
  6. Atlassian redirects to:

https://functions.azure.com/auth/bitbucket/reactviews/callback/env/PROD/extension/Websites?state=...&code=...

  1. The Microsoft callback returns HTTP 404.

We reproduced the issue with multiple Bitbucket accounts and multiple App Services, so it does not appear to be account-specific or resource-specific.

We then tested the Microsoft callback endpoint directly with curl and found a deterministic query-string length boundary:

?state=test&code=<1007 ASCII characters>

-> HTTP 302

?state=test&code=<1008 ASCII characters>

-> HTTP 404

The fixed "?state=test&code=" part is 17 bytes, therefore:

17 + 1007 = 1024 bytes -> HTTP 302

17 + 1008 = 1025 bytes -> HTTP 404

The current authorization code returned by Atlassian is longer than this limit, so the real OAuth callback fails.

The callback route itself works with a short code:

?state=test123&code=test456

-> HTTP 302

-> https://portal.azure.com/TokenAuthorize/ExtensionName/WebsitesExtension?code=test456&state=test123

This suggests that the callback route itself is valid, but requests fail once the query string exceeds 1024 bytes.

Is this a known regression in the Azure App Service Bitbucket integration?

Is there a supported workaround or fix for configuring Bitbucket continuous deployment while this callback issue is present?

Azure App Service
Azure App Service

Azure App Service is a service used to create and deploy scalable, mission-critical web apps.

Answer accepted by question author
Ajay Rathod 440 Reputation points Microsoft External Staff Moderator
2026-09-02T17:59:57.9766667+00:00

RCA:

Bitbucket continuous deployment — Azure App Service Deployment Center UX

Since 00:01 UTC on 5 August 2026, customers configuring Bitbucket CI/CD in Deployment Center have been unable to complete the Bitbucket sign-in step. Authorization on the Bitbucket consent page succeeds, but the redirect back to Azure returns an HTTP 404 instead of returning you to the portal.

The cause is a defect in our web server configuration that caused the authorization request's query string to be counted twice against a maximum-length limit, effectively halving it. The defect was latent and harmless until 5 August, when the format of the authorization code issued by Bitbucket changed and grew roughly fourfold, pushing most callbacks past that limit. No change was made on the Azure side that day. Other deployment sources, including GitHub and Azure Repos, are unaffected, and Bitbucket deployments that are already configured continue to build and deploy normally — only new setup and re-authorization are blocked.

We have identified the root cause, developed a fix, and confirmed it in testing. It is currently rolling out to production regions. In the meantime, manual deployment remains available and unaffected.

 

Was this answer helpful?

3 people found this answer helpful.

0 additional answers

Sort by: Newest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.