Node.js fetch failing with mitm proxy and basic auth

[chrmarti]

@chrmarti Yes that appears to be spot on

GitHub Copilot Chat Diagnostics output

GitHub Copilot Chat

• Extension Version: 0.24.2025012802 (prod)
• VS Code: vscode/1.97.0-insider
• OS: Mac

Network

User Settings:

  "http.proxy": "http://localhost:9999",
  "github.copilot.advanced.debug.useElectronFetcher": true,
  "github.copilot.advanced.debug.useNodeFetcher": false,
  "github.copilot.advanced.debug.useNodeFetchFetcher": true

Connecting to https://api.github.com:

• DNS ipv4 Lookup: 140.82.114.5 (11 ms)
• DNS ipv6 Lookup: ::ffff:140.82.114.5 (5 ms)
• Proxy URL: http://localhost:9999 (0 ms)
• Proxy Connection: 407 Proxy Authentication Required
  proxy-authenticate: Basic realm="mitmproxy" (34 ms)
• Electron fetch (configured): HTTP 200 (82 ms)
• Node.js https: HTTP 200 (80 ms)
• Node.js fetch: Error (23 ms): fetch failed
  Request was cancelled.
  Proxy response (407) !== 200 when HTTP Tunneling
• Helix fetch: Error (174 ms): Miscellaneous failure (see text): no credential for 1221457B-73E4-463F-9A4A-B270AD5C8FF3

Connecting to https://api.githubcopilot.com/_ping:

• DNS ipv4 Lookup: 140.82.114.22 (27 ms)
• DNS ipv6 Lookup: ::ffff:140.82.114.22 (2 ms)
• Proxy URL: http://localhost:9999 (1 ms)
• Proxy Connection: 407 Proxy Authentication Required
  proxy-authenticate: Basic realm="mitmproxy" (31 ms)
• Electron fetch (configured): HTTP 200 (74 ms)
• Node.js https: HTTP 200 (88 ms)
• Node.js fetch: Error (24 ms): fetch failed
  Request was cancelled.
  Proxy response (407) !== 200 when HTTP Tunneling
• Helix fetch: Error (12 ms): Miscellaneous failure (see text): no credential for 1221457B-73E4-463F-9A4A-B270AD5C8FF3 (negative cache)

Documentation

In corporate networks: Troubleshooting firewall settings for GitHub Copilot.

Running a proxy, but not in wsl or any vs code remote, so I'm not sure why electron wouldn't be enabled, per: https://github.com/devm33/vscode/blob/419205a8ff1252fc6a3a8e085b8645f2ab51a0ec/extensions/github-authentication/src/node/fetch.ts#L6-L12

The github-authentication extension runs in the standard extension host right?

Originally posted by @devm33 in #207867

[devm33]

Here's what I see debugging the extension host:

Exception has occurred: AbortError: Proxy response (407) !== 200 when HTTP Tunneling
  at Client.connect (/Applications/Visual Studio Code - Insiders.app/Contents/Resources/app/node_modules/undici/lib/dispatcher/proxy-agent.js:84:22)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)

[chrmarti]

This broke when updating undici. Fixed in the next Insiders and added tests for fetch and proxy auth.

[joshspicer]

I've emulated @devm33's copilot chat logs with mitmproxy + a trusted ssl cert. I am able to log into github auth successfully through the proxy

## GitHub Copilot Chat

- Extension Version: 0.24.2025012902 (prod)
- VS Code: vscode/1.97.0-insider
- OS: Mac

## Network

User Settings:
```json
  "http.proxy": "http://localhost:9999",
  "github.copilot.advanced.debug.useElectronFetcher": true,
  "github.copilot.advanced.debug.useNodeFetcher": false,
  "github.copilot.advanced.debug.useNodeFetchFetcher": true

Connecting to https://api.github.com:

• DNS ipv4 Lookup: 20.201.28.148 (1 ms)
• DNS ipv6 Lookup: ::ffff:20.201.28.148 (1 ms)
• Proxy URL: http://localhost:9999 (0 ms)
• Proxy Connection: 200 Connection established (196 ms)
• Electron fetch (configured): HTTP 200 (333 ms)
• Node.js https: HTTP 200 (617 ms)
• Node.js fetch: HTTP 200 (780 ms)
• Helix fetch: HTTP 200 (748 ms)

Connecting to https://api.individual.githubcopilot.com/_ping:

• DNS ipv4 Lookup: 140.82.114.22 (1 ms)
• DNS ipv6 Lookup: ::ffff:140.82.114.22 (2 ms)
• Proxy URL: http://localhost:9999 (0 ms)
• Proxy Connection: 200 Connection established (85 ms)
• Electron fetch (configured): HTTP 200 (91 ms)
• Node.js https: HTTP 200 (276 ms)
• Node.js fetch: HTTP 200 (288 ms)
• Helix fetch: HTTP 200 (282 ms)

Documentation

In corporate networks: Troubleshooting firewall settings for GitHub Copilot.

[joshspicer]

I'm now realizing i've tested with an insiders commit (d99174934eea1507e98714b203e8b93802f7dd2f) that doesn't have this fix, so likely i'm not reproing the issue correctly? Does my proxy need to request basic auth to repro this bug?

[chrmarti]

@joshspicer Yes, there is a proxyauth option. Using mitmweb:

[chrmarti]

When auth is configured the diagnostics will show a 407 on the Proxy Connection row (which tries to connect without credentials as a test).

[joshspicer]

I have enabled the relevant settings, proxying the requests through a mitm proxy with proxyauth set. After authenticating with my credentials I have no problem signing into github with the auth extension 👍

## GitHub Copilot Chat

- Extension Version: 0.24.2025013001 (prod)
- VS Code: vscode/1.97.0-insider
- OS: Mac

## Network

User Settings:

  "http.proxy": "http://localhost:9999",
  "github.copilot.advanced.debug.useElectronFetcher": true,
  "github.copilot.advanced.debug.useNodeFetcher": false,
  "github.copilot.advanced.debug.useNodeFetchFetcher": true


Connecting to https://api.github.com:
- DNS ipv4 Lookup: 20.201.28.148 (2 ms)
- DNS ipv6 Lookup: ::ffff:20.201.28.148 (10 ms)
- Proxy URL: http://localhost:9999 (0 ms)
- Proxy Connection: 407 Proxy Authentication Required
	proxy-authenticate: Basic realm="mitmproxy" (6 ms)
- Electron fetch (configured): HTTP 200 (201 ms)
- Node.js https: HTTP 200 (626 ms)
- Node.js fetch: HTTP 200 (816 ms)
- Helix fetch: Error (181 ms): Miscellaneous failure (see text): unable to reach any KDC in realm REDMOND.CORP.MICROSOFT.COM, tried 0 KDCs

Connecting to https://api.enterprise.githubcopilot.com/_ping:
- DNS ipv4 Lookup: 140.82.112.22 (1 ms)
- DNS ipv6 Lookup: ::ffff:140.82.112.22 (2 ms)
- Proxy URL: http://localhost:9999 (0 ms)
- Proxy Connection: 407 Proxy Authentication Required
	proxy-authenticate: Basic realm="mitmproxy" (5 ms)
- Electron fetch (configured): HTTP 200 (89 ms)
- Node.js https: HTTP 200 (268 ms)
- Node.js fetch: HTTP 200 (606 ms)
- Helix fetch: Error (26 ms): Miscellaneous failure (see text): unable to reach any KDC in realm REDMOND.CORP.MICROSOFT.COM, tried 0 KDCs

## Documentation

In corporate networks: [Troubleshooting firewall settings for GitHub Copilot](https://docs.github.com/en/copilot/troubleshooting-github-copilot/troubleshooting-firewall-settings-for-github-copilot).