[Bug]: extensions pomdtr.excalidraw-editor-3.5.2-universal static resource net::ERR_ABORTED 401

[Gu-f]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: Chrome Ver-113.0.5672.126
• Local OS: windows11
• Remote OS: Centos7.6
• Remote Architecture: x86_64
• code-server --version: 4.14.1 5c19962 with Code 1.79.2

Steps to Reproduce

1. code-server --install-extension pomdtr.excalidraw-editor
2. run code-server
3. create file demo.excalidraw
4. open file demo.excalidraw
5. view browser console

Expected

response 200
excalidraw renders normally

Actual

net::ERR_ABORTED 401
excalidraw cannot be rendered

Logs

browser console:

Request URL:
https://vscode-remote+vscode-002emydomain-002etop.vscode-resource.vscode-cdn.net/root/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.5.2-universal/public/static/js/main.7ef26bea.js
Request Method:
GET
Status Code:
401 (from service worker)
Referrer Policy:
strict-origin-when-cross-origin

Request URL:
https://vscode-remote+vscode-002emydomain-002etop.vscode-resource.vscode-cdn.net/root/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.5.2-universal/public/static/css/main.11acca1e.css
Request Method:
GET
Status Code:
401 (from service worker)
Referrer Policy:
strict-origin-when-cross-origin

Screenshot/Video

No response

Does this issue happen in VS Code or GitHub Codespaces?

• I cannot reproduce this in VS Code.
• I cannot reproduce this in GitHub Codespaces.

Are you accessing code-server over HTTPS?

• I am using HTTPS.

Notes

No response

[Gu-f]

code-server: 4.13.0 2798322 with Code 1.78.2
After testing, this version of code-server works properly

[pomdtr]

Thanks for the investigation!

[code-asher]

The behavior I am seeing is a bit different. excalidraw-editor is working for me (I can create demo.excalidraw and draw shapes) on code-server 4.14.1 if I install via the command line (I tried both Firefox and Chromium). Is there anything at all unusual about your setup? I am not sure where the 401 would be coming from. I enabled password authentication but that works for me as well. Does this reproduce for you in an incognito window? Or in another browser? Interestingly though, if I install via the UI it gets installed as a browser extension and does not work although I am not seeing 401 errors then either. I do see some 404s and 406s trying to make requests to open-vsx.org though. But this seems to be a different issue.

[Gu-f]

https - I used caddy. And I upgraded from 4.13.0 to 4.14.1, I just replaced all the files in the project's root directory. Some files like cache or extension package may not have been replaced. I'm not sure if those are the reasons, but I'll do the test again sometime.

[Gu-f]

More complete reproduction steps:

1. Download centos7-minimal iso image link
2. Install system
3. Configuring network connections.
4. Install Caddy.

.1. yum install yum-plugin-copr
.2. yum copr enable @caddy/caddy
.3. yum install caddy
.4. Create Caddyfile and write content:

vscode.testserver.dev *.vscode.testserver.dev {
	tls internal
	reverse_proxy 127.0.0.1:23456
}

(Caddy file: Note that use tabs instead of 4/8 Spaces. Otherwise, the fmt command may have a problem)
.5. start caddy: execute command: caddy fmt && caddy adapt && caddy run

5. Install code-server

.1. Download code-server-4.14.1-linux-amd64.tar.gz link
.2. tar -zxvf code-server-4.14.1-linux-amd64.tar.gz
.3. cd code-server-4.14.1-linux-amd64/bin/
.4. ./code-server --install-extension pomdtr.excalidraw-editor
.5. PASSWORD=123456 VSCODE_PROXY_URI=https://{{port}}.vscode.testserver.dev ./code-server --bind-addr 127.0.0.1:23456 --proxy-domain vscode.testserver.dev

6. Modify system host-file. Add vscode.testserver.dev 192.168.1.10
7. Install /root/.local/share/caddy/pki/authorities/local/root.crt to the (visiter)system's trusted root certificate.(My visiter system is win11)
8. Open chrome ,visit https://vscode.testserver.dev/
9. Create file demo.excalidraw
10. F12 capture network in browser
11. Open file demo.excalidraw
12. 401 appears and cannot draw

Please try the above steps. Hopefully this will make the problem come up again.
I tried switching the system RockyLinux had the same problem.

[code-asher]

Is the self-signed certificate trusted on your browser?

Caddy is supposed to install them for you but in my case I had to add Caddy's CA to Chrome's trust store to even get it to load the site. Once I loaded the site Excalidraw worked for me.

I am running this on Ubuntu though.

Do you get the same issue without TLS through Caddy? Although I am not sure how a cert issue could cause a 401 so this might not be relevant.

What if you load it directly without a reverse proxy?

[Gu-f]

Self-signed certificates are trusted.I'm sorry. I missed a step.
Install /root/.local/share/caddy/pki/authorities/local/root.crt to the (win)system's trusted root certificate.

No reverse proxy:
I also tried to directly use code-server --cert --cert-key to load the certificate generated by caddy, but I still had the same problem.
Command is PASSWORD=123456 VSCODE_PROXY_URI=https://{{port}}.vscode.testserver.dev ./code-server --bind-addr 0.0.0.0:443 --cert /root/.local/share/caddy/certificates/local/vscode.testserver.dev/vscode.testserver.dev.crt --cert-key /root/.local/share/caddy/certificates/local/vscode.testserver.dev/vscode.testserver.dev.key --proxy-domain vscode.testserver.dev

Strangely, static resources for other extensions, such as draw.io, load normally.
So I don't really know whose bug it is.
Do some extensions require specific permissions? That's just my guess...

[Gu-f]

I tested ubuntu.
Oh my God! It only works properly on ubuntu systems !
Is there a better way to find out why other systems aren't working properly?

[Gu-f]

code-server: 4.13.0 2798322 with Code 1.78.2 After testing, this version of code-server works properly

code-server: 4.13.0 doesn't have that problem, 4.13.0 to 4.14.1 are there some security-related changes that caused this problem?

[code-asher]

It only works properly on ubuntu systems !

Interesting! I tried to reproduce with a CentOS Docker image but it still works for me. Maybe it does not reproduce in Docker? Here is what I tried: ``` docker run -it -p 8080:8080 centos sh curl -L https://code-server.dev/install.sh | sh code-server --install-extension pomdtr.excalidraw-editor PASSWORD=test code-server --host 0.0.0.0 ``` Then I opened a private window (to make sure my cache was clear) and went to http://localhost:8080/?folder=/root.

`code-server: 4.13.0` doesn't have that problem, 4.13.0 to 4.14.1 are there some security-related changes that caused this problem?

Very strange. I am not seeing anything that could be affecting this. I do not believe any changes to authentication were made, at least. There was an update to VS Code though. These particular assets are requested through the service worker so maybe a change was made there that caused this. Do you still get the 401 if you use --auth none? Just to see if the 401 is coming from code-server or somewhere else.

[Gu-f]

Do you still get the 401 if you use --auth none? Just to see if
the 401 is coming from code-server or somewhere else.

The same problem occurs with --auth none. It looks like ServiceWorker.

The initiator located it here

I don't know if that helps.

Interesting! I tried to reproduce with a CentOS Docker image but
it still works for me. Maybe it does not reproduce in Docker?
Here is what I tried:

In docker:
I tried it, too. Able to draw normally.

Outside docker:
I perform the same steps as you, except that I do not perform the first step.

~~ docker run -it -p 8080:8080 centos sh ~~(Non-execution)
curl -L https://code-server.dev/install.sh | sh
code-server --install-extension pomdtr.excalidraw-editor
PASSWORD=test code-server --host 0.0.0.0

401 came out.

Judging from the tests above, installing a centos/rocky system in a VM(I use VMware) should be easy to reproduce.

[code-asher]

So strange, if auth is off then I have no idea where the 401 comes from. To double-check, have you already tried in a private/incognito window to rule out caching issues with the service worker? I did briefly try to launch a CentOS VM but for some reason I am having trouble getting the networking to work so for now this is as far as I can go.

[Gu-f]

Yes, I have tried the private/incognito window. I also tried to clear the cache, the problem still exists.

Note:
Release-v4.13.0 is the dividing line.
version le(<=) Release-v4.13.0: normal
version gt(>) Release-v4.13.0: abnormal (include latest v4.15.0)

[code-asher]

Bummer, but thank you for trying. There were two features added between those versions but I am not seeing how they could cause this so I think it is likely the update from Code 1.78.2 to 1.79.2; someone will have to step through or bisect once they can reproduce. v4.13.0...v4.14.0 I will try again with the VM but I might not get to it soon. In the meantime if you think of anything else unique about your setup or a different way to reproduce please let me know.

[MrPeacockNLB]

any news on this issue? I really like excalidraw but currently I've got to switch to my local VSCode as it is not working anymore.

Using latest code-server version:

code-server: v4.16.1
Code: 1.80.2
Commit: 2ccd690cbff1569e4a83d7c43d45101f817401dc
Date: 2023-07-31T17:15:21.760Z
Browser: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

As a side node the remote installed extension (inside a Coder workspace) does not show up in remote extension panel.

[code-asher]

No updates. I have not had a chance to try the VM again. Are you also running in a CentOS VM?

[MrPeacockNLB]

No we're using coder workspaces. The workspace image is manjaro based.

[MrPeacockNLB]

can you give me an hint howto compile and run code-server locally? I can try to bisect this one.

[code-asher]

The instructions are described here: https://github.com/coder/code-server/blob/main/docs/CONTRIBUTING.md#development-workflow

But if my suspicions about the issue being inside VS Code are true then a bisect will be difficult because we have no good way to bisect individual VS Code commits between each version.

[code-asher]

If the problem is in VS Code then it might make sense to try and reproduce with VS Code alone rather than through code-server, then the bisect should be easier.

[MrPeacockNLB]

ah I see what you mean. Maybe I should try to serve VS Code via code serve-web. Then this should not work too. If so then clone code directly and bisect.

[MrPeacockNLB]

Hi @code-asher,

yesterday I did a quick test and installed latest code-server v4.17.1. Now I can open excalidraw sheets again.

[code-asher]

Great news!

[krisek]

yesterday I did a quick test and installed latest code-server v4.17.1. Now I can open excalidraw sheets again.

Interesting, excalidraw extension works for me only on v4.16.1 and extension version 3.5.1 (on debian testing, verified on two installations, with https).

If I upgrade any of the two, excalidraw stops working.

Any tricks?

[krisek]

More debugging shows something weird, when I try to open an excalidraw file the client tries to retrieve two resources from:

https://vscode-remote+my-002edomain-003a40000.vscode-resource.vscode-cdn.net/__myhomedir__/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.6.1-universal/public/static/js/main.75859edd.js
https://vscode-remote+my-002edomain-003a40000.vscode-resource.vscode-cdn.net/__myhomedir__/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.6.1-universal/public/static/css/main.11acca1e.css

which obviously fail... very interesting.

[krisek]

setting

auth: none

solves the issue on latest code-server with the latest version of the extension
code-server: v4.18.0
Excalidraw v3.6.1
on Debian testing

[Gu-f]

setting

auth: none

solves the issue on latest code-server with the latest version of the extension code-server: v4.18.0 Excalidraw v3.6.1 on Debian testing

Yes, those two resources main.75859edd.js and main.11acca1e.css
In my browser, these two resources 401.

I tried to go over and change the settings auth: none . Still have bugs.
code-server: v4.18.0
Excalidraw v3.6.1
on Rocky Linux release 9.1 (Blue Onyx)

But interesting...
I saw successful access to the resource the moment I restarted code-server. Only once, a bug appears after refreshing
To avoid caching, I tried to execute the browser in the sandbox, but it didn't work.

[krisek]

Yes, i must admit the solution works only if I disable/enable the extension and reload the app once more after opening code-server on client side.

[code-asher]

I am not still not sure what is going on, but I can at least comment on the weird vscode-remote+ URLs. I think (but am not sure) that VS Code registers network interceptors in the service worker so these requests are not actually made normally, instead the interceptor fetches the content through the web socket and then replies to the request with that data.

But as to why they 401 in that case...no idea. I am not sure if I have tried with auth on yet so I will have to give it a go.

[code-asher]

Closing for now since the problem does not seem to be in code-server, but please feel free to continue commenting, and we can reopen if we discover anything.

[krisek]

In the meanwhile I don't have this issue anymore, most probably subsequent updates fixed it

[lrstanley]

still experiencing this with the latest version of code-server, as well as excalidraw extension. It looks like either the extension (or code-server) is causing the extension to load it's web assets directly from openvsx.org, rather than through the virtual filesystem with the files embedded in the extension.

I looked at the code of the extension, and it doesn't look any different from other extensions loading assets (index.html/css for embedded web views), and it doesn't occur when running the excalidraw extension locally/outside of code-server.

I believe this is an issue with code server, or whatever code-server is based off, which is providing the wrong base/file URL to the extension, for which it tries to load things.

EDIT:

Yes, i must admit the solution works only if I disable/enable the extension and reload the app once more after opening code-server on client side.

I have found that when the browser version is uninstalled, but it still is installed (on code-server), this seems to work (at least in our case, because the server doesn't have the same corporate firewall restrictions). however, I haven't found a way to tell an extension to only be server-side, if the extension supports browser and server. So the next reload often causes it to break again.

[code-asher]

Yeah I noticed the same thing. I think the only way to make it install on the server is to use --install-extension via the cli, and not install through the UI.

Edit: I believe browser extensions pull their files directly from the marketplace, so this is by design even though personally I think they should have downloaded it to the remote and pulled the files off there. Maybe it was done this way to also support vscode.dev which has no backend though.

[code-asher]

Actually I just tried again on code-server 4.91.0 with it installed as a browser extension and it is working as expected. 🤔

[lrstanley]

Even if the extension "works", the problem is that something is causing the extension to load files directly from openvsx.org, rather than from within code-server and the virtual filesystem endpoints. It only becomes a problem if you cannot connect to openvsx.org (or similar). Some more info below.

Reproduction steps:

1. Run code-server in docker:

   docker run -it --name code-server -p 8080:8080 \
     -v "$PWD:/home/coder" \
     -u "$(id -u):$(id -g)" \
     -e "DOCKER_USER=$USER" \
     codercom/code-server:latest
   

2. open http://localhost:8080
3. put in generated password
4. install pomdtr.excalidraw-editor
5. open dev tools (make sure to do this first!)
6. create a new file called test.excalidraw.png (or some other way of opening the view for excalidraw)
7. look at the network tab within dev tools, and find the endpoints that are being hit being openvsx.org (and others).

In my case, I am running this test from my personal device, so there are no network issues reaching outbound. This does not work in many corporate environments, however.

This is an issue for a few reasons:

1. code-server runs from one environment, but the browser runs from another. In corporate environments, or environments with some kind of internet firewall, this can be problematic as code-server may be less restrictive than the browser and creates inconsistencies/network requires that would be unexpected.
2. the files in question are bundled with the extension, so it shouldn't need to reach out to those endpoints.
3. when I try something similar with vscode locally, not code-server, I don't see that it reaches out to microsofts marketplace or some other external endpoint.

code-server info from the above test:

code-server: v4.91.1
Code: 1.91.1
Commit: 1962f48b7f71772dc2c060dbaa5a6b4c0792a549
Date: 2024-07-15T17:58:33.007Z (2 days ago)
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0

extension version: v3.7.4

[lrstanley]

this is the code on the excalidraw extension side that does the loading of the webview content:

https://github.com/excalidraw/excalidraw-vscode/blob/42253cd9b74a21c8de60433a6eef574f458483b4/extension/src/editor.ts#L345-L363

looking at the official docs, I don't see anything wrong with this:
https://code.visualstudio.com/api/extension-guides/webview#loading-local-content

not sure how or where this.context.extensionUri (where I think the source of the issue may be) is an external URL, rather than some virtual fs endpoint of some kind.

[code-asher]

the problem is that something is causing the extension to load files directly from openvsx.org

I agree this is dumb, but as mentioned this is just how web extensions work by design as far as I can tell so not much we can do about it, except maybe file an issue with VS Code.

You should see similar requests on the web versions of VS Code like vscode.dev and Codespaces, but not with the desktop version as it does not use web extensions.

This is controlled by the resourceUrlTemplate property of the extension gallery, which is configurable via the EXTENSIONS_GALLERY environment variable so one workaround would be to omit resourceUrlTemplate which I believe would disable web extensions altogether. But, this might not be ideal because some extensions you might want to be web extensions, like Vim to avoid round trips every time you type a character.

[code-asher]

For restrictive corporate environments typically the folks we work with host their own marketplace on premise using https://github.com/coder/code-marketplace, or the marketplace is proxied or whitelisted, if that helps.

They have to do this even without using web extensions anyway, because extension queries (like searching for extensions) also occur from the browser, last I checked.