Repository: vscode
Issue: Visual Studio Code Server "code tunnel" doesn't use authenticated proxy when connecting to relay
Labels: feature-request,code-cli

<!-- ⚠️⚠️ Do Not Delete This! bug_report_template ⚠️⚠️ -->
<!-- Please read our Rules of Conduct: https://opensource.microsoft.com/codeofconduct/ -->
<!-- 🕮 Read our guide about submitting issues: https://github.com/microsoft/vscode/wiki/Submitting-Bugs-and-Suggestions -->
<!-- 🔎 Search existing issues to avoid creating duplicates. -->
<!-- 🧪 Test using the latest Insiders build to see if your issue has already been fixed: https://code.visualstudio.com/insiders/ -->
<!-- 💡 Instead of creating your report here, use 'Report Issue' from the 'Help' menu in VS Code to pre-fill useful information. -->
<!-- 🔧 Launch with `code --disable-extensions` to check. -->
Does this issue occur when all extensions are disabled?: N/A

<!-- 🪓 If you answered No above, use 'Help: Start Extension Bisect' from Command Palette to try to identify the cause. -->
<!-- 📣 Issues caused by an extension need to be reported directly to the extension publisher. The 'Help > Report Issue' dialog can assist with this. -->
- VS Code Version: code-insiders 1.97.0 (commit 079df18bc89a113d831a43fa36c2f472136d5b40)
- OS Version: Rocky9

**Description of issue:**
When starting a vscode server with "code tunnel" while accessing the internet via an http proxy that requires authentication, we receive the warning: 
`warn Error connecting to relay, will retry: error connecting to tunnel: error sending tunnel CONNECT request: response error: HTTP status 407 Proxy Authentication Required`
Oddly, the initial conection to authenticate and authorize happily uses the proxy but the connection to the replay fails

**Steps to Reproduce:**
1. Ensure HTTP_PROXY and HTTPS_PROXY environment variables are set
2. wget a fresh "code-insiders" to be sure we're playing with latest, and to illustrate that wget is honouring the authenticated proxy URL
3. run `code-insiders ./code-insiders tunnel --verbose --log trace`
4.

**Expected results:**
1. I'd expect it to start up a tunnel and give me a URL to hit with my browser to use vscode

**Actual results:**
1. HTTP status 407 Proxy Authentication Required response from the proxy server that shows the full http://username:password@proxyserver:port

**Notes:**
1. As illustrated in notes above and session below, the HTTPS_Proxy is set and proven to be working using wget
2. The redacted proxy password does not have any special characters that need URLEncoding

**Redacted session log:**
```
[myuser@internalhost ~]$ wget https://vscode.download.prss.microsoft.com/dbazure/download/insider/079df18bc89a113d831a43fa36c2f472136d5b40/vscode_cli_alpine_x64_cli.tar.gz
--2024-12-12 09:24:47--  https://vscode.download.prss.microsoft.com/dbazure/download/insider/079df18bc89a113d831a43fa36c2f472136d5b40/vscode_cli_alpine_x64_cli.tar.gz
Resolving webproxy.our.internal.net (webproxy.our.internal.net)... 10.1.2.3     
Connecting to webproxy.our.internal.net (webproxy.our.internal.net)|10.1.2.3|:8080... connected.
Proxy request sent, awaiting response... 200 OK                                 
Length: 9046713 (8.6M) [application/octet-stream]                               
Saving to: ‘vscode_cli_alpine_x64_cli.tar.gz’                                   
                                                                                
vscode_cli_alpine_x64_cli.tar.gz  100%[===========================================================>]   8.63M  --.-KB/s    in 0.04s
                                                                                
2024-12-12 09:24:47 (193 MB/s) - ‘vscode_cli_alpine_x64_cli.tar.gz’ saved [9046713/9046713]
                                                                                
[myuser@internalhost ~]$ tar zxvf vscode_cli_alpine_x64_cli.tar.gz              
code-insiders                                                                   
[myuser@internalhost ~]$ ./code-insiders tunnel --verbose --log trace           
*                                                                               
* Visual Studio Code Server                                                     
*                                                                               
* By using the software, you agree to                                           
* the Visual Studio Code Server License Terms (https://aka.ms/vscode-server-license) and
* the Microsoft Privacy Statement (https://privacy.microsoft.com/en-US/privacystatement).
*                                                                               
[2024-12-12 09:25:09] debug Starting tunnel with `code-insiders ./code-insiders tunnel --verbose --log trace`
[2024-12-12 09:25:09] debug starting as new singleton                           
[2024-12-12 09:25:09] debug [os_info::imp::lsb_release] lsb_release command failed with Os { code: 2, kind: NotFound, message: "No such file or directory" }
[2024-12-12 09:25:09] debug No code server tunnel found, creating new one       
[2024-12-12 09:25:14] debug Using file keychain storage due to: keyring communication timed out after 5s
[2024-12-12 09:25:14] trace No token in keyring, getting a new one              
✔ How would you like to log in to Visual Studio Code - Insiders? · Microsoft Account
[2024-12-12 09:25:18] debug [reqwest::connect] starting new connection: https://login.microsoftonline.com/
[2024-12-12 09:25:18] debug [reqwest::connect] proxy(http://webproxy.our.internal.net:8080) intercepts 'https://login.microsoftonline.com/'
[2024-12-12 09:25:18] debug [reqwest::connect] tunnel to login.microsoftonline.com:443 using basic auth
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code PCCTQFYMF to authenticate.
[2024-12-12 09:25:23] trace refresh poll failed, retrying: Error getting authorization: authorization_pending AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling. Trace ID: ba597600-902d-46a0-a9ec-a75f13ff0000 Correlation ID: 506d21d4-b556-42a1-b328-e277df66e5d3 Timestamp: 2024-12-11 23:25:23Z
[2024-12-12 09:25:28] trace refresh poll failed, retrying: Error getting authorization: authorization_pending AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling. Trace ID: 65ed15a6-0b16-43c0-8360-b42301c46000 Correlation ID: 506d21d4-b556-42a1-b328-e277df66e5d3 Timestamp: 2024-12-11 23:25:28Z
[2024-12-12 09:25:33] trace refresh poll failed, retrying: Error getting authorization: authorization_pending AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling. Trace ID: 491833d0-7f78-44a0-8d7e-e1bd0ee70b00 Correlation ID: 506d21d4-b556-42a1-b328-e277df66e5d3 Timestamp: 2024-12-11 23:25:33Z
[2024-12-12 09:25:38] trace refresh poll failed, retrying: Error getting authorization: authorization_pending AADSTS70016: OAuth 2.0 device flow error. Authorization is pending. Continue polling. Trace ID: c2b4b405-8b78-4f25-bb60-73647cff1d00 Correlation ID: 506d21d4-b556-42a1-b328-e277df66e5d3 Timestamp: 2024-12-11 23:25:38Z
[2024-12-12 09:25:44] debug [reqwest::connect] starting new connection: https://global.rel.tunnels.api.visualstudio.com/
[2024-12-12 09:25:44] debug [reqwest::connect] proxy(http://webproxy.our.internal.net:8080) intercepts 'https://global.rel.tunnels.api.visualstudio.com/'
[2024-12-12 09:25:44] debug [reqwest::connect] tunnel to global.rel.tunnels.api.visualstudio.com:443 using basic auth
✔ What would you like to call this machine? · internalhostourintern   
[2024-12-12 09:25:51] info Creating tunnel with the name: internalhostourintern
[2024-12-12 09:25:51] trace Found token in keyring                              
[2024-12-12 09:25:55] trace Found token in keyring                              
[2024-12-12 09:25:55] debug Starting tunnel to server...                        
[2024-12-12 09:25:55] trace Found token in keyring                              
[2024-12-12 09:25:55] debug [reqwest::connect] starting new connection: https://aue.rel.tunnels.api.visualstudio.com/
[2024-12-12 09:25:55] debug [reqwest::connect] proxy(http://webproxy.our.internal.net:8080) intercepts 'https://aue.rel.tunnels.api.visualstudio.com/'
[2024-12-12 09:25:55] debug [reqwest::connect] tunnel to aue.rel.tunnels.api.visualstudio.com:443 using basic auth
[2024-12-12 09:25:55] debug [tunnels::connections::relay_tunnel_host] connecting via http_proxy on http://proxyuser:MyActualPassword@webproxy.our.internal.net:8080/
[2024-12-12 09:25:55] warn Error connecting to relay, will retry: error connecting to tunnel: error sending tunnel CONNECT request: response error: HTTP status 407 Proxy Authentication Required from http://proxyuser:MyActualPassword@webproxy.our.internal.net:8080/ (request ID <none>): <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
...
### html 407 response from our proxy server
...
[2024-12-12 09:25:55] error Error connecting to tunnel endpoint: error connecting to tunnel: error sending tunnel CONNECT request: response error: HTTP status 407 Proxy Authentication Required from http://proxyuser:MyActualPassword@webproxy.our.internal.net:8080/ (request ID <none>): <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
...
### html 407 response from our proxy server
...
[2024-12-12 09:25:55] trace Found token in keyring
```