[Bug]: extensions pomdtr.excalidraw-editor-3.5.2-universal static resource net::ERR_ABORTED 401

[Gu-f]

Is there an existing issue for this?

• [X] I have searched the existing issues

OS/Web Information

• Web Browser: Chrome Ver-113.0.5672.126
• Local OS: windows11
• Remote OS: Centos7.6
• Remote Architecture: x86_64
• code-server --version: 4.14.1 5c199629305a0b935b4388b7db549f77eae82b5a with Code 1.79.2

Steps to Reproduce

1. code-server --install-extension pomdtr.excalidraw-editor
2. run code-server
3. create file demo.excalidraw
4. open file demo.excalidraw
5. view browser console

Expected

response 200
excalidraw renders normally

Actual

net::ERR_ABORTED 401
excalidraw cannot be rendered

Logs

browser console:

Request URL:
https://vscode-remote+vscode-002emydomain-002etop.vscode-resource.vscode-cdn.net/root/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.5.2-universal/public/static/js/main.7ef26bea.js
Request Method:
GET
Status Code:
401 (from service worker)
Referrer Policy:
strict-origin-when-cross-origin

Request URL:
https://vscode-remote+vscode-002emydomain-002etop.vscode-resource.vscode-cdn.net/root/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.5.2-universal/public/static/css/main.11acca1e.css
Request Method:
GET
Status Code:
401 (from service worker)
Referrer Policy:
strict-origin-when-cross-origin

Screenshot/Video

No response

Does this issue happen in VS Code or GitHub Codespaces?

• [X] I cannot reproduce this in VS Code.
• [X] I cannot reproduce this in GitHub Codespaces.

Are you accessing code-server over HTTPS?

• [X] I am using HTTPS.

Notes

No response

[Gu-f]

code-server: 4.13.0 2798322b03e7f446f59c5142215c11711ed7a427 with Code 1.78.2 After testing, this version of code-server works properly

[pomdtr]

Thanks for the investigation!

[code-asher]

The behavior I am seeing is a bit different.

excalidraw-editor is working for me (I can create demo.excalidraw and draw shapes) on code-server 4.14.1 if I install via the command line (I tried both Firefox and Chromium).

Is there anything at all unusual about your setup? I am not sure where the 401 would be coming from. I enabled password authentication but that works for me as well. Does this reproduce for you in an incognito window? Or in another browser?

Interestingly though, if I install via the UI it gets installed as a browser extension and does not work although I am not seeing 401 errors then either. I do see some 404s and 406s trying to make requests to open-vsx.org though. But this seems to be a different issue.

[Gu-f]

https - I used caddy. And I upgraded from 4.13.0 to 4.14.1, I just replaced all the files in the project's root directory. Some files like cache or extension package may not have been replaced. I'm not sure if those are the reasons, but I'll do the test again sometime.

[Gu-f]

More complete reproduction steps:

1. Download centos7-minimal iso image link
2. Install system
3. Configuring network connections.
4. Install Caddy.

.1. yum install yum-plugin-copr .2. yum copr enable @caddy/caddy .3. yum install caddy .4. Create Caddyfile and write content:

vscode.testserver.dev *.vscode.testserver.dev {
	tls internal
	reverse_proxy 127.0.0.1:23456
}

(Caddy file: Note that use tabs instead of 4/8 Spaces. Otherwise, the fmt command may have a problem)
.5. start caddy: execute command: caddy fmt && caddy adapt && caddy run

5. Install code-server

.1. Download code-server-4.14.1-linux-amd64.tar.gz link
.2. tar -zxvf code-server-4.14.1-linux-amd64.tar.gz .3. cd code-server-4.14.1-linux-amd64/bin/ .4. ./code-server --install-extension pomdtr.excalidraw-editor .5. PASSWORD=123456 VSCODE_PROXY_URI=https://{{port}}.vscode.testserver.dev ./code-server --bind-addr 127.0.0.1:23456 --proxy-domain vscode.testserver.dev

6. Modify system host-file. Add vscode.testserver.dev 192.168.1.10
7. Install /root/.local/share/caddy/pki/authorities/local/root.crt to the (visiter)system's trusted root certificate.(My visiter system is win11)
8. Open chrome ,visit https://vscode.testserver.dev/
9. Create file demo.excalidraw
10. F12 capture network in browser
11. Open file demo.excalidraw
12. 401 appears and cannot draw

Please try the above steps. Hopefully this will make the problem come up again.
I tried switching the system RockyLinux had the same problem.

[code-asher]

Is the self-signed certificate trusted on your browser?

Caddy is supposed to install them for you but in my case I had to add Caddy's CA to Chrome's trust store to even get it to load the site. Once I loaded the site Excalidraw worked for me.

I am running this on Ubuntu though.

Do you get the same issue without TLS through Caddy? Although I am not sure how a cert issue could cause a 401 so this might not be relevant.

What if you load it directly without a reverse proxy?

[Gu-f]

Self-signed certificates are trusted.I'm sorry. I missed a step.
Install /root/.local/share/caddy/pki/authorities/local/root.crt to the (win)system's trusted root certificate.

No reverse proxy:
I also tried to directly use code-server --cert --cert-key to load the certificate generated by caddy, but I still had the same problem. Command is PASSWORD=123456 VSCODE_PROXY_URI=https://{{port}}.vscode.testserver.dev ./code-server --bind-addr 0.0.0.0:443 --cert /root/.local/share/caddy/certificates/local/vscode.testserver.dev/vscode.testserver.dev.crt --cert-key /root/.local/share/caddy/certificates/local/vscode.testserver.dev/vscode.testserver.dev.key --proxy-domain vscode.testserver.dev

Strangely, static resources for other extensions, such as draw.io, load normally.
So I don't really know whose bug it is.
Do some extensions require specific permissions? That's just my guess...

[Gu-f]

I tested ubuntu. Oh my God! It only works properly on ubuntu systems ! Is there a better way to find out why other systems aren't working properly?

[Gu-f]

code-server: 4.13.0 2798322 with Code 1.78.2 After testing, this version of code-server works properly

code-server: 4.13.0 doesn't have that problem, 4.13.0 to 4.14.1 are there some security-related changes that caused this problem?

[code-asher]

It only works properly on ubuntu systems !

Interesting! I tried to reproduce with a CentOS Docker image but it still works for me. Maybe it does not reproduce in Docker? Here is what I tried:

docker run -it -p 8080:8080 centos sh
curl -L https://code-server.dev/install.sh | sh
code-server --install-extension pomdtr.excalidraw-editor
PASSWORD=test code-server --host 0.0.0.0

Then I opened a private window (to make sure my cache was clear) and went to http://localhost:8080/?folder=/root.

code-server: 4.13.0 doesn't have that problem, 4.13.0 to 4.14.1 are there some security-related changes that caused this problem?

Very strange. I am not seeing anything that could be affecting this. I do not believe any changes to authentication were made, at least.

There was an update to VS Code though. These particular assets are requested through the service worker so maybe a change was made there that caused this.

Do you still get the 401 if you use --auth none? Just to see if the 401 is coming from code-server or somewhere else.

[Gu-f]

Do you still get the 401 if you use --auth none? Just to see if the 401 is coming from code-server or somewhere else.

The same problem occurs with --auth none. It looks like ServiceWorker.

The initiator located it here

I don't know if that helps.

Interesting! I tried to reproduce with a CentOS Docker image but it still works for me. Maybe it does not reproduce in Docker? Here is what I tried:

In docker:
I tried it, too. Able to draw normally.

Outside docker: I perform the same steps as you, except that I do not perform the first step.

~~ docker run -it -p 8080:8080 centos sh ~~(Non-execution)
curl -L https://code-server.dev/install.sh | sh
code-server --install-extension pomdtr.excalidraw-editor
PASSWORD=test code-server --host 0.0.0.0

401 came out.

Judging from the tests above, installing a centos/rocky system in a VM(I use VMware) should be easy to reproduce.

[code-asher]

So strange, if auth is off then I have no idea where the 401 comes from.

To double-check, have you already tried in a private/incognito window to rule out caching issues with the service worker?

I did briefly try to launch a CentOS VM but for some reason I am having trouble getting the networking to work so for now this is as far as I can go.

[Gu-f]

Yes, I have tried the private/incognito window. I also tried to clear the cache, the problem still exists.

Note: Release-v4.13.0 is the dividing line.
version le(<=) Release-v4.13.0: normal
version gt(>) Release-v4.13.0: abnormal (include latest v4.15.0)

[code-asher]

Bummer, but thank you for trying.

There were two features added between those versions but I am not seeing how they could cause this so I think it is likely the update from Code 1.78.2 to 1.79.2; someone will have to step through or bisect once they can reproduce.

https://github.com/coder/code-server/compare/v4.13.0...v4.14.0

I will try again with the VM but I might not get to it soon. In the meantime if you think of anything else unique about your setup or a different way to reproduce please let me know.

[MrPeacockNLB]

any news on this issue? I really like excalidraw but currently I've got to switch to my local VSCode as it is not working anymore.

Using latest code-server version:

code-server: v4.16.1 Code: 1.80.2 Commit: 2ccd690cbff1569e4a83d7c43d45101f817401dc Date: 2023-07-31T17:15:21.760Z Browser: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36

As a side node the remote installed extension (inside a Coder workspace) does not show up in remote extension panel.

[code-asher]

No updates. I have not had a chance to try the VM again. Are you also running in a CentOS VM?

[MrPeacockNLB]

No we're using coder workspaces. The workspace image is manjaro based.

[MrPeacockNLB]

can you give me an hint howto compile and run code-server locally? I can try to bisect this one.

[code-asher]

The instructions are described here: https://github.com/coder/code-server/blob/main/docs/CONTRIBUTING.md#development-workflow

But if my suspicions about the issue being inside VS Code are true then a bisect will be difficult because we have no good way to bisect individual VS Code commits between each version.

[code-asher]

If the problem is in VS Code then it might make sense to try and reproduce with VS Code alone rather than through code-server, then the bisect should be easier.

[MrPeacockNLB]

ah I see what you mean. Maybe I should try to serve VS Code via code serve-web. Then this should not work too. If so then clone code directly and bisect.

[MrPeacockNLB]

Hi @code-asher,

yesterday I did a quick test and installed latest code-server v4.17.1. Now I can open excalidraw sheets again.

[code-asher]

Great news!

[krisek]

yesterday I did a quick test and installed latest code-server v4.17.1. Now I can open excalidraw sheets again.

Interesting, excalidraw extension works for me only on v4.16.1 and extension version 3.5.1 (on debian testing, verified on two installations, with https).

If I upgrade any of the two, excalidraw stops working.

Any tricks?

[krisek]

More debugging shows something weird, when I try to open an excalidraw file the client tries to retrieve two resources from:

https://vscode-remote+my-002edomain-003a40000.vscode-resource.vscode-cdn.net/myhomedir/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.6.1-universal/public/static/js/main.75859edd.js https://vscode-remote+my-002edomain-003a40000.vscode-resource.vscode-cdn.net/myhomedir/.local/share/code-server/extensions/pomdtr.excalidraw-editor-3.6.1-universal/public/static/css/main.11acca1e.css

which obviously fail... very interesting.

[krisek]

setting

auth: none

solves the issue on latest code-server with the latest version of the extension code-server: v4.18.0 Excalidraw v3.6.1 on Debian testing

[Gu-f]

setting

auth: none

solves the issue on latest code-server with the latest version of the extension code-server: v4.18.0 Excalidraw v3.6.1 on Debian testing

Yes, those two resources main.75859edd.js and main.11acca1e.css
In my browser, these two resources 401.

I tried to go over and change the settings auth: none . Still have bugs.
code-server: v4.18.0
Excalidraw v3.6.1
on Rocky Linux release 9.1 (Blue Onyx)

But interesting...
I saw successful access to the resource the moment I restarted code-server. Only once, a bug appears after refreshing
To avoid caching, I tried to execute the browser in the sandbox, but it didn't work.

[krisek]

Yes, i must admit the solution works only if I disable/enable the extension and reload the app once more after opening code-server on client side.

[code-asher]

I am not still not sure what is going on, but I can at least comment on the weird vscode-remote+ URLs. I think (but am not sure) that VS Code registers network interceptors in the service worker so these requests are not actually made normally, instead the interceptor fetches the content through the web socket and then replies to the request with that data.

But as to why they 401 in that case...no idea. I am not sure if I have tried with auth on yet so I will have to give it a go.

[code-asher]

Closing for now since the problem does not seem to be in code-server, but please feel free to continue commenting, and we can reopen if we discover anything.