Issues with Azure AD Authentication in Reflex Deployed to Azure Container Apps

[RandomBrown]

According to my company's policies, I am deploying a Reflex application running as a container in Azure Container Apps, exposing a single port to the internet.

I’ve followed this guide for the setup:
https://azureossd.github.io/2024/08/24/Deploying-Reflex-Application-to-Azure-Container-Apps/

Here’s my Dockerfile:

# This Dockerfile is used to deploy a single-container Reflex app instance
# to services like Render, Railway, Heroku, GCP, and others.

# It uses a reverse proxy to serve the frontend statically and proxy to backend
# from a single exposed port, expecting TLS termination to be handled at the
# edge by the given platform.
FROM python:3.12

# If the service expects a different port, provide it here (f.e Render expects port 10000)
ARG PORT=8080
# Only set for local/direct access. When TLS is used, the API_URL is assumed to be the same as the frontend.
ARG API_URL
ENV PORT=$PORT API_URL=${API_URL:-http://localhost:$PORT} REDIS_URL=redis://localhost PYTHONUNBUFFERED=1

# # Install odbc driver for SQL Server (debian) Microsoft ODBC 18
RUN curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg
RUN curl https://packages.microsoft.com/config/debian/12/prod.list | tee /etc/apt/sources.list.d/mssql-release.list
RUN apt-get update
RUN ACCEPT_EULA=Y apt-get install -y msodbcsql18

# Install Caddy and redis server inside image
RUN apt-get update -y && apt-get install -y caddy redis-server && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy local context to `/app` inside container (see .dockerignore)
COPY . .

# Crear y activar un entorno virtual
RUN python -m venv /app/venv
ENV PATH="/app/venv/bin:$PATH"

#Actualizar pip
RUN pip install --upgrade pip

# Install app requirements and reflex in the container
RUN pip install -r requirements.txt

# Deploy templates and prepare app
RUN reflex init

# Download all npm dependencies and compile frontend
RUN reflex export --frontend-only --no-zip && mv .web/_static/* /srv/ && rm -rf .web

# Needed until Reflex properly passes SIGTERM on backend.
STOPSIGNAL SIGKILL

EXPOSE $PORT

# Apply migrations before starting the backend.
# CMD [ -d alembic ] && reflex db migrate; \
#     caddy start && \
#     redis-server --daemonize yes && \
#     exec reflex run --env prod --backend-only
CMD [ -d alembic ] && reflex db migrate; \
    caddy start && \
    redis-server --daemonize yes && \
    exec reflex run --env prod --backend-only

My Caddyfile before enabling authentication with Azure AD looked like this:

:{$PORT}

encode gzip

@backend_routes path /_event/* /ping /_upload /_upload/*
handle @backend_routes {
        reverse_proxy localhost:8000
}

root * /srv
route {
        try_files {path} {path}/ /404.html
        file_server
}

And now, with authentication, it’s configured like this (observe the path to authentication pages):

:{$PORT}

log {
    output file /app/caddy_access.log
    format json
}

encode gzip

@backend_routes path /_event/* /ping /_upload /_upload/* /auth/*
handle @backend_routes {
        # Pasar cabeceras críticas para Azure AD/Autenticación
        reverse_proxy localhost:8000 {
                header_up X-Forwarded-For {remote_host}
                header_up Host {host}
                header_up Authorization {http.request.header.Authorization}
        }
}

root * /srv
route {
        try_files {path} {path}/ /404.html
        file_server
}

Everything worked smoothly during the development phase. However, now that I’m in production, I’ve encountered an issue.

I added Azure AD authentication to my Reflex app using this tutorial:
https://reflex.dev/blog/2024-11-19-microsoft-azure-authentication/

When running the app locally on my development machine, everything functions perfectly. Azure AD authentication works as expected.

However, when I deploy the container to Azure Container Apps and try logging in, authentication fails.

Checking Caddy’s logs, it seems to process the request and redirect correctly:

{
  "level": "error",
  "ts": 1744721074.1756198,
  "logger": "http.log.access.log0",
  "msg": "handled request",
  "request": {
    "remote_ip": "100.100.0.59",
    // ...
    "method": "GET",
    "host": "xxxx.xxxx.northeurope.azurecontainerapps.io",
    "uri": "/auth/callback?code=1.AXkAnz...&state=jQVBsdfssPWlcwrqknOX&session_state=003ee5a9...",
    // ...
  },
  "user_id": "",
  "duration": 0.001894398,
  "size": 22,
  "status": 404,
  "resp_headers": {
    "Date": ["Tue, 15 Apr 2025 12:44:33 GMT"],
    "Server": ["Caddy", "uvicorn"], // <-- Important!
    "Content-Length": ["22"],
    "Content-Type": ["application/json"]
  }
}

Despite this, I receive a 404 error, likely returned by Uvicorn, and it occurs very quickly.

Can someone help me figure this out? Or at least point me in the direction of where the issue might be happening?

Can anyone help me pinpoint the issue? Thanks in advance!

[johschmidt42]

Can you confirm that your ASGI app (fastAPI) has this endpoint /auth/callback defined?
Check the logs of your container app, you should be seeing a 404 in stdout.