ECONNREFUSED when attempting to POST to emulator from within local Docker container

  azure-cosmosdb, docker, node.js

I have a Node.js based app, and am using the Azure/cosmos-sign package to generate the correct headers via the generateHeaders method to save a JSON object in the local Cosmos Emulator.

Upon trying to post from the Node app to the URI provided in the Emulator Quickstart (https://localhost:8081), the error returned is…

Error: connect ECONNREFUSED : https://localhost:8081

As per these instructions

Enable access to emulator on a local network

If you have multiple machines using a single network, and if you set
up the emulator on one machine and want to access it from other
machine. In such case, you need to enable access to the emulator on a
local network.

You can run the emulator on a local network. To enable network access,
specify the /AllowNetworkAccess option at the command-line, which
also requires that you specify /Key=key_string or
/KeyFile=file_name. You can use /GenKeyFile=file_name to generate
a file with a random key upfront. Then you can pass that to
/KeyFile=file_name or /Key=contents_of_file.

To enable network access for the first time, the user should shut down
the emulator and delete the emulator’s data directory


…I thought perhaps I needed to enable the networking functionality. It is all on the same (Windows) host (with the Node.js application running in Docker on the same host as the Emulator is installed). But this caused more problems with no benefit. With the generated key, I can load the included UI for managing the local emulator instance, but I then can’t create Databases or Containers (without resetting the emulator and starting it again normally, eg: without the AllowNetworkAccess and related settings).

Attempting to use the included Explorer to create a Database returns…

Error while creating database SampleDb:
    "code": 401,
    "body": {
        "code": "Unauthorized",
        "message": "The input authorization token can't serve the request. Please check that the expected payload is built as per the protocol, and check the key being used. Server used the following payload to sign: 'postndbsnnmon, 29 mar 2021 23:33:45 gmtnn'rnActivityId: 29e4e700-d1b7-4d59-bdea-5931e4d6622d, Microsoft.Azure.Documents.Common/2.11.0"
    "headers": {
        "access-control-allow-credentials": "true",
        "access-control-allow-origin": "https://localhost:8081",
        "access-control-expose-headers": "Access-Control-Allow-Origin,Access-Control-Allow-Credentials,Content-Type,x-ms-activity-id,x-ms-gatewayversion",
        "content-type": "application/json",
        "date": "Mon, 29 Mar 2021 23:33:45 GMT",
        "server": "Microsoft-HTTPAPI/2.0",
        "x-firefox-spdy": "h2",
        "x-ms-activity-id": "29e4e700-d1b7-4d59-bdea-5931e4d6622d",
        "x-ms-gatewayversion": "version=2.11.0",
        "x-ms-throttle-retry-count": 0,
        "x-ms-throttle-retry-wait-time-ms": 0
    "activityId": "29e4e700-d1b7-4d59-bdea-5931e4d6622d"

I did see this somewhat similar SO question, but it was abandoned.

This one, however seems to imply they simply reverted the KeyFile steps mentioned in the MS Docs. It seems odd that I am getting the same error from the Node.js POST regardless of if I use the AllowNetworkAccess switch or not.

Using the /NoFirewall switch as recommended here didnt resolve POSTs but did allow the Explorer UI to still work properly. The upvoted answer for that question is what I have already tried (/AllowNetworkAccess /KeyFile=...., and is not working, as explained above).

The docs here indicate that TLS (https) is in fact required…

"The Azure Cosmos DB Emulator supports only secure communication via TLS"

However, here they seem to indicate that, in the Node SDK (which relies on the same cosmos-sign library I am using)…

"TLS verification is disabled. By default the Node.js SDK(version 1.10.1 or higher) for the SQL API will not try to use the TLS/SSL certificate when connecting to the local emulator."

I tried adjusting the start script for my Node Docker image as suggested here

If connecting to the Cosmos DB Emulator, disable TLS verification
for your node process:

const client = new CosmosClient({ endpoint, key });

…and changed the start script in my package.json from…

"start": "node $NODE_OPTIONS node_modules...."


"start": "NODE_TLS_REJECT_UNAUTHORIZED=0 node $NODE_OPTIONS node_modules...."

…and rebuilt my images, but still receive the same ECONNREFUSED error from the Node client/app.

Source: Docker Questions