title: ECONNREFUSED when attempting to POST to emulator from within local Docker container
body: <h1>TLDR:</h1>
  <p>Can't <code>post</code> to local Cosmos Emulator.  Can <code>post</code> to Azure Cosmos, but not with <a href="https://www.npmjs.com/package/@azure/cosmos-sign" rel="nofollow noreferrer">@azure/cosmos-sign</a>, only with <a href="https://www.npmjs.com/package/@azure/cosmos" rel="nofollow noreferrer">@azure/cosmos</a> (which seems utterly bizare as the latter is supposedly built upon the former.)  This is not ideal (as the message signing portion alone is very lightweight with REST API directly).  Bug, or user error?  Why do the <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator?tabs=cli%2Cssl-netstd21#enable-access-to-emulator-on-a-local-network" rel="nofollow noreferrer">instructions for enabling networking/https</a> not seem to work?</p>
  <h1>Details:</h1>
  <p>I have a Node.js based app, and am using the <a href="https://www.npmjs.com/package/@azure/cosmos-sign" rel="nofollow noreferrer">Azure/cosmos-sign package</a> to generate the correct headers via the <a href="https://github.com/Azure/cosmos-sign#generate-a-headers-object-instead" rel="nofollow noreferrer">generateHeaders</a> method to save a JSON object in the <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator" rel="nofollow noreferrer">local Cosmos Emulator</a>.</p>
  <p>Upon trying to <code>post</code> from the Node app to the URI provided in the Emulator Quickstart (<code>https://localhost:8081</code>), the error returned is...</p>
  <blockquote>
  <p>Error: connect ECONNREFUSED 127.0.0.1:8081 : https://localhost:8081</p>
  </blockquote>
  <p>As per <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator?tabs=cli%2Cssl-netstd21#enable-access-to-emulator-on-a-local-network" rel="nofollow noreferrer">these instructions</a>...</p>
  <blockquote>
  <p><strong>Enable access to emulator on a local network</strong></p>
  <p>If you have multiple machines using a single network, and if you set
  up the emulator on one machine and want to access it from other
  machine. In such case, you need to enable access to the emulator on a
  local network.</p>
  <p>You can run the emulator on a local network. To enable network access,
  specify the <code>/AllowNetworkAccess</code> option at the command-line, which
  also requires that you specify <code>/Key=key_string</code> or
  <code>/KeyFile=file_name</code>. You can use <code>/GenKeyFile=file_name</code> to generate
  a file with a random key upfront. Then you can pass that to
  <code>/KeyFile=file_name</code> or <code>/Key=contents_of_file</code>.</p>
  <p>To enable network access for the first time, the user should shut down
  the emulator and delete the emulator's data directory
  <em>%LOCALAPPDATA%\CosmosDBEmulator</em>.</p>
  </blockquote>
  <p>-https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator?tabs=cli%2Cssl-netstd21#enable-access-to-emulator-on-a-local-network</p>
  <p>...I thought perhaps I needed to enable the networking functionality.  It is all on the same (Windows) host (with the Node.js application running in Docker on the same host as the Emulator is installed).  But this caused more problems with no benefit.  With the generated key, I can load <a href="https://localhost:8081/_explorer/index.html" rel="nofollow noreferrer">the included UI</a> for managing the local emulator instance, but I then can't create Databases or Containers (without resetting the emulator and starting it again normally, eg: without the <code>AllowNetworkAccess</code> and related settings).</p>
  <p>Attempting to use the included Explorer to create a Database returns...</p>
  <pre><code>Error while creating database SampleDb:
  {
      &quot;code&quot;: 401,
      &quot;body&quot;: {
          &quot;code&quot;: &quot;Unauthorized&quot;,
          &quot;message&quot;: &quot;The input authorization token can't serve the request. Please check that the expected payload is built as per the protocol, and check the key being used. Server used the following payload to sign: 'post\ndbs\n\nmon, 29 mar 2021 23:33:45 gmt\n\n'\r\nActivityId: 29e4e700-d1b7-4d59-bdea-5931e4d6622d, Microsoft.Azure.Documents.Common/2.11.0&quot;
      },
      &quot;headers&quot;: {
          &quot;access-control-allow-credentials&quot;: &quot;true&quot;,
          &quot;access-control-allow-origin&quot;: &quot;https://localhost:8081&quot;,
          &quot;access-control-expose-headers&quot;: &quot;Access-Control-Allow-Origin,Access-Control-Allow-Credentials,Content-Type,x-ms-activity-id,x-ms-gatewayversion&quot;,
          &quot;content-type&quot;: &quot;application/json&quot;,
          &quot;date&quot;: &quot;Mon, 29 Mar 2021 23:33:45 GMT&quot;,
          &quot;server&quot;: &quot;Microsoft-HTTPAPI/2.0&quot;,
          &quot;x-firefox-spdy&quot;: &quot;h2&quot;,
          &quot;x-ms-activity-id&quot;: &quot;29e4e700-d1b7-4d59-bdea-5931e4d6622d&quot;,
          &quot;x-ms-gatewayversion&quot;: &quot;version=2.11.0&quot;,
          &quot;x-ms-throttle-retry-count&quot;: 0,
          &quot;x-ms-throttle-retry-wait-time-ms&quot;: 0
      },
      &quot;activityId&quot;: &quot;29e4e700-d1b7-4d59-bdea-5931e4d6622d&quot;
  }
  </code></pre>
  <p>I did see <a href="https://stackoverflow.com/questions/59263261/cosmos-db-emulator-refusing-connections-for-the-gremlin-endpoint">this somewhat similar SO question</a>, but it was abandoned.</p>
  <p><a href="https://stackoverflow.com/a/60503067/3246805">This one</a>, however seems to imply they simply reverted the KeyFile steps mentioned in the MS Docs.  It seems odd that I am getting the same error from the Node.js POST regardless of if I use the <code>AllowNetworkAccess</code> switch or not.</p>
  <p>Using the <code>/NoFirewall</code> switch as recommended <a href="https://stackoverflow.com/a/55080968/3246805">here</a> didnt resolve POSTs but did allow the Explorer UI to still work properly.  The <a href="https://stackoverflow.com/a/55084824/3246805">upvoted answer</a> for that question is what I have already tried (<code>/AllowNetworkAccess /KeyFile=....</code>, and is not working, as explained above).</p>
  <p>The docs <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator?tabs=cli%2Cssl-netstd21#authenticate-requests" rel="nofollow noreferrer">here</a> indicate that TLS (https) is in fact required...</p>
  <blockquote>
  <p>&quot;The Azure Cosmos DB Emulator supports only secure communication via TLS&quot;</p>
  </blockquote>
  <p>However, <a href="https://docs.microsoft.com/en-us/azure/cosmos-db/local-emulator-export-ssl-certificates#how-to-use-the-certificate-in-nodejs" rel="nofollow noreferrer">here</a> they seem to indicate that, in the <a href="https://www.npmjs.com/package/@azure/cosmos" rel="nofollow noreferrer">Node SDK</a> (<a href="https://docs.microsoft.com/en-US/azure/cosmos-db/sql-api-sdk-node#section" rel="nofollow noreferrer">which relies on the same</a> <a href="https://www.npmjs.com/package/@azure/cosmos-sign" rel="nofollow noreferrer">cosmos-sign</a> library I am using)...</p>
  <blockquote>
  <p>&quot;TLS verification is disabled.  By default the Node.js SDK(version 1.10.1 or higher) for the SQL API will not try to use the TLS/SSL certificate when connecting to the local emulator.&quot;</p>
  </blockquote>
  <p>I tried adjusting the start script for my Node Docker image as suggested <a href="https://docs.microsoft.com/en-US/azure/cosmos-db/sql-api-nodejs-get-started#connect-to-the-azure-cosmos-account" rel="nofollow noreferrer">here</a>...</p>
  <blockquote>
  <p>If connecting to the <strong>Cosmos DB Emulator</strong>, disable TLS verification
  for your node process:</p>
  <pre><code>process.env.NODE_TLS_REJECT_UNAUTHORIZED = &quot;0&quot;;
  const client = new CosmosClient({ endpoint, key });
  </code></pre>
  </blockquote>
  <p>...and changed the start script in my <code>package.json</code> from...</p>
  <pre><code>&quot;start&quot;: &quot;node $NODE_OPTIONS node_modules....&quot;
  </code></pre>
  <p>...to...</p>
  <pre><code>&quot;start&quot;: &quot;NODE_TLS_REJECT_UNAUTHORIZED=0 node $NODE_OPTIONS node_modules....&quot;
  </code></pre>
  <p>...and rebuilt my images, but still receive the same <code>ECONNREFUSED</code> error from the Node client/app.</p>
  <p>As I was reading the <a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/create-a-document" rel="nofollow noreferrer">documentation for the REST API</a> I was reminded that, as opposed to using the <code>CosmosClient</code> (which just needs the base URL), to do a <code>post</code> to the API the url needs to be fully formed as indicated <a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/create-a-document#request" rel="nofollow noreferrer">here</a>...</p>
  <blockquote>
  <p><strong>Method:</strong> POST <br>
  <strong>Request URI:</strong> https://{databaseaccount}.documents.azure.com/dbs/{db-id}/colls/{coll-id}/docs <br>
  <strong>Description:</strong> The {databaseaccount} is the name of the Azure Cosmos DB account created under your subscription. The {db-id} value is the
  user generated name/ID of the database, not the system generated ID
  (rid). The {coll-id} value is the name of the collection that contains
  the document.</p>
  </blockquote>
  <p>After appending <code>/dbs/SampleDB/colls/SampleCollection/docs</code> (yes, my entities are CamelCase) to the base url offered by the Emulator UI's Quickstart URI (<code>https://localhost:8081</code>)... I am still getting the <strong>ECONNREFUSED</strong> error to http <code>post</code>s.</p>
  <p>Hmm... retargeted the Node app to point to a collection in my Azure Cosmos DB, and I am still having no luck.</p>
  <blockquote>
  <p>400: Invalid API version. Ensure a valid x-ms-version header value is
  passed. Please update to the latest version of Azure Cosmos DB
  SDK.ActivityId: bfdeb339-8fef-4ba9-a03d-444a8664c02b,
  Microsoft.Azure.Documents.Common/2.11.0</p>
  </blockquote>
  <p>Added <code>x-ms-version</code> and set it to <code>2018-12-31</code> (latest, as per <a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/#supported-rest-api-versions" rel="nofollow noreferrer">here</a>).</p>
  <p>Now I am getting (after trying both my secondary, and primary keys... just in case)...</p>
  <blockquote>
  <p>401: The input authorization token can't serve the request. Please
  check that the expected payload is built as per the protocol, and
  check the key being used. Server used the following payload to sign:
  'postdocsdbs/TopHand/colls/SampleTbltue, 30 mar 2021 02:54:25
  gmt'ActivityId: bb258bb4-f5a8-4495-b0b5-b54fa8b7c46f,
  Microsoft.Azure.Documents.Common/2.11.0</p>
  </blockquote>
  <p>I verified that the <a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/common-cosmosdb-rest-request-headers" rel="nofollow noreferrer">required headers</a> are all present.  What can possibly be left?!</p>
  <p>Base URI for Azure Cosmos had a trailing <code>/</code>, which ended up duplicated when the rest of the path was appended.  Fixing the url string, still getting the 401.</p>
  <p>A <a href="https://github.com/Azure/azure-cosmosdb-node/issues/82#issuecomment-213777157" rel="nofollow noreferrer">github issue</a> pointed me to what may have been an error in the URL/REST path I was posting to.  Rather than posting to (what I had previously)...</p>
  <p><code>dbs/SampleDb/colls/SampleTbl/docs</code></p>
  <p>...I changed it to...</p>
  <p><code>dbs/SampleDb/colls/SampleTbl</code></p>
  <p>...and am now getting error <code>405, MethodNotAllowed, RequestHandler.Post</code>.  <code>405</code> isn't listed as <a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/http-status-codes-for-cosmosdb" rel="nofollow noreferrer">code returned by the Cosmos REST service</a>.</p>
  <p><a href="https://docs.microsoft.com/en-us/rest/api/cosmos-db/create-a-document#example" rel="nofollow noreferrer">This example</a> in the MS docs definitely uses the <code>/docs</code> string at the end of the url/REST path.</p>
  <blockquote>
  <p><strong>Example</strong></p>
  <pre><code>POST https://querydemo.documents.azure.com/dbs/1KtjAA==/colls/1KtjAImkcgw=/docs HTTP/1.1  
  x-ms-documentdb-partitionkey: [&quot;Andersen&quot;]  
  x-ms-date: Tue, 29 Mar 2016 02:28:29 GMT  
  authorization: type%3dmaster%26ver%3d1.0%26sig%3d92WMAkQv0Zu35zpKZD%2bcGSH%2b2SXd8HGxHIvJgxhO6%2fs%3d
  Cache-Control: no-cache  
  User-Agent: Microsoft.Azure.Documents.Client/1.6.0.0  
  x-ms-version: 2015-12-16  
  Accept: application/json  
  Host: querydemo.documents.azure.com  
  Cookie: x-ms-session-token#0=602; x-ms-session-token=602  
  Content-Length: 344  
  Expect: 100-continue  
    
  {  
    &quot;id&quot;: &quot;AndersenFamily&quot;,  
    &quot;LastName&quot;: &quot;Andersen&quot;,  
  }
  </code></pre>
  </blockquote>