{"record":{"id":"b5d9fd85f30a917f","repo":"netbirdio/netbird","slug":"no-available-port-found-from-configured-redirect-u","errorCode":null,"errorMessage":"no available port found from configured redirect URLs: %q","messagePattern":"no available port found from configured redirect URLs: %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/internal/auth/pkce_flow.go","lineNumber":110,"sourceCode":"\tcodeVerifier   string\n\toAuthConfig    *oauth2.Config\n}\n\n// NewPKCEAuthorizationFlow returns new PKCE authorization code flow.\nfunc NewPKCEAuthorizationFlow(config PKCEAuthProviderConfig) (*PKCEAuthorizationFlow, error) {\n\tvar availableRedirectURL string\n\n\texcludedRanges := getSystemExcludedPortRanges()\n\n\tfor _, redirectURL := range config.RedirectURLs {\n\t\tif !isRedirectURLPortUsed(redirectURL, excludedRanges) {\n\t\t\tavailableRedirectURL = redirectURL\n\t\t\tbreak\n\t\t}\n\t}\n\n\tif availableRedirectURL == \"\" {\n\t\treturn nil, fmt.Errorf(\"no available port found from configured redirect URLs: %q\", config.RedirectURLs)\n\t}\n\n\tcfg := &oauth2.Config{\n\t\tClientID:     config.ClientID,\n\t\tClientSecret: config.ClientSecret,\n\t\tEndpoint: oauth2.Endpoint{\n\t\t\tAuthURL:  config.AuthorizationEndpoint,\n\t\t\tTokenURL: config.TokenEndpoint,\n\t\t},\n\t\tRedirectURL: availableRedirectURL,\n\t\tScopes:      strings.Split(config.Scope, \" \"),\n\t}\n\n\treturn &PKCEAuthorizationFlow{\n\t\tproviderConfig: config,\n\t\toAuthConfig:    cfg,\n\t}, nil\n}","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/internal/auth/pkce_flow.go#L92-L128","documentation":"Returned by NewPKCEAuthorizationFlow when every configured redirect URL is unusable (client/internal/auth/pkce_flow.go:109-111). A URL is skipped when isRedirectURLPortUsed reports its port occupied (a successful TCP dial to host:port) or inside OS-excluded port ranges (pkce_flow.go:364-396; on Windows, reserved ranges from getSystemExcludedPortRanges). If none of RedirectURLs survives, no local callback server can start and flow construction fails.","triggerScenarios":"For each redirect URL, either another process already listens on its port (another netbird login in progress, any app on that port) or the port falls in a Windows excluded range (Hyper-V/WinNAT dynamic reservations). All configured ports failing simultaneously produces this error.","commonSituations":"Windows machines where Hyper-V/WSD reserves wide port ranges that overlap NetBird's configured loopback ports; a previous netbird up still holding the callback port; concurrent logins from the desktop app and CLI; Docker/WSL workloads binding the same localhost ports.","solutions":["Free the occupied port: finish or kill the other login attempt / process listening on the redirect port (netstat -ano | grep <port>)","On Windows, inspect reserved ranges: netsh int ipv4 show excludedportrange protocol=tcp - if they cover your ports, restart winnat (net stop winnat && net start winnat) or have the admin add redirect URLs on unreserved ports","Administrator: configure multiple redirect URLs on widely separated ports in the IdP/management config so at least one is free","Retry netbird up once ports are released"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check candidate redirect ports before constructing the flow\nfunc portAvailable(rawURL string) bool {\n\tu, err := url.Parse(rawURL)\n\tif err != nil {\n\t\treturn false\n\t}\n\tln, err := net.Listen(\"tcp\", net.JoinHostPort(\"127.0.0.1\", u.Port()))\n\tif err != nil {\n\t\treturn false\n\t}\n\treturn ln.Close() == nil\n}\n\n// usable := 0\n// for _, r := range redirectURLs { if portAvailable(r) { usable++ } }","typeGuard":null,"tryCatchPattern":"flow, err := auth.NewPKCEAuthorizationFlow(cfg)\nif err != nil && strings.Contains(err.Error(), \"no available port found from configured redirect URLs\") {\n\t// free the listed ports or extend the redirect URL list in the IdP/management config\n}","preventionTips":["Configure several redirect URLs on separated ports so one busy port cannot kill the flow","On Windows, check 'netsh int ipv4 show excludedportrange protocol=tcp' when reservations overlap the ports, and restart winnat to shrink them","Avoid concurrent netbird logins (CLI plus desktop app) on the same host","Free the port from the process holding it before retrying"],"tags":["pkce","redirect-url","ports","windows","hyper-v","concurrency"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}