Github OAuth fails

[zhenry9]

I'm having a real hard time getting the Github integration features to work properly. Clicking on anything like "Publish to Github" takes me to an OAuth screen, and when I click continue I get a "Oh no! An error occurred!
Please restart the sign in process from the editor. Forbidden" error. Returning to the code-server instance I can click "Logging into Github" on the bottom bar, at which point I'm prompted for a URI. Entering the URI results in an Unauthorized error.

This behavior is different from the exact same version/commit of code-server running on my computer natively. The Github login process simply prompts me for a personal access token and is successful when I enter it.

I am able to clone a repository from the command line using a personal access token git clone https://<PAT>@github.com/user.repo.git and push and pull correctly in that repo only after that.

---

Expected Behavior

Github OAuth should be successful, or code-server should ask for a personal access token instead.

Current Behavior

Github OAuth flow fails. Code-server never asks for PAT.

Steps to Reproduce

1. Open new folder in code-server.
2. Go to source control tab and click "Publish to Github", and "OK" to open OAuth browser window.
3. Click "Continue" on Github OAuth prompt.
4. OAuth fails with forbidden error.

Environment

OS: Docker on OMV on Proxmox, running behind traefik2 container, secure domain
CPU architecture: x86_64
How docker service was installed:

Official Docker repo

Command used to create docker container (run/create/compose/screenshot)

code-server:
image: linuxserver/code-server
container_name: code-server
networks:
t2_proxy:
environment:
- PUID=$PUID
- PGID=$PGID
- TZ=$TZ
- PASSWORD=$RC_PASSWD
#- HASHED_PASSWORD= #optional
- SUDO_PASSWORD=$RC_PASSWD
#- SUDO_PASSWORD_HASH= #optional
- PROXY_DOMAIN=code.$DOMAINNAME0 #optional
- DEFAULT_WORKSPACE=/config/workspace #optional
secrets:
- code_server_pw
volumes:
- $STORAGE/appdata/code-server:/config
- $STORAGE/repos:/home/repos
labels:
- "traefik.enable=true"
- "traefik.http.routers.code-server-rtr.entrypoints=https"
- "traefik.http.routers.code-server-rtr.rule=Host(code.$DOMAINNAME0)"
- "traefik.http.routers.code-server-rtr.middlewares=middlewares-rate-limit@file,chain-oauth@file"
- "traefik.http.routers.code-server-rtr.service=code-server-svc"
- "traefik.http.services.code-server-svc.loadbalancer.server.port=8443"
ports:
- 8443:8443
restart: unless-stopped

Docker logs

[cont-init.d] 10-adduser: exited 0.
[cont-init.d] 30-config: executing...
setting up sudo access
adding abc to sudoers
setting sudo password using SUDO_PASSWORD env var
New password: Retype new password: passwd: password updated successfully
setting permissions::configuration
setting permissions::workspace
[cont-init.d] 30-config: exited 0.
[cont-init.d] 90-custom-folders: executing...
[cont-init.d] 90-custom-folders: exited 0.
[cont-init.d] 99-custom-scripts: executing...
[custom-init] no custom files found exiting...
[cont-init.d] 99-custom-scripts: exited 0.
[cont-init.d] done.
[services.d] starting services
[services.d] done.
[2022-01-18T10:59:57.045Z] info code-server 4.0.1 735c6da829535969ff7193c79379299e4a1cb9bc
[2022-01-18T10:59:57.095Z] info Using user-data-dir ~/data
[2022-01-18T10:59:57.443Z] info Using config file ~/.config/code-server/config.yaml
[2022-01-18T10:59:57.460Z] info HTTP server listening on http://0.0.0.0:8443/
[2022-01-18T10:59:57.492Z] info - Authentication is enabled
[2022-01-18T10:59:57.507Z] info - Using password from $PASSWORD
[2022-01-18T10:59:57.510Z] info - Not serving HTTPS
[2022-01-18T10:59:57.519Z] info - Proxying the following domain:
[2022-01-18T10:59:57.531Z] info - *.code.xxxxxxx.com
[03:00:35] Extension host agent started.
[03:00:42] No ptyHost heartbeat after 6 seconds
[03:00:44] Deleted from disk github.vscode-pull-request-github /config/extensions/github.vscode-pull-request-github-0.34.3

[github-actions]

Thanks for opening your first issue here! Be sure to follow the bug or feature issue templates!

[Marnalas]

I have the exact same problem.

I tried to deactivate some securities thinking that maybe they were preventing the callbackUri to be called successfully : https://vscode-auth.github.com/authorize/?callbackUri=https://_subdomain.domain_/callback...

But nothing has worked so far.

Is your DNS record also managed by Cloudflare and proxied (not "DNS only") ?

[zhenry9]

My DNS is managed by cloudflare, but since it's the free version it doesn't proxy wildcard CNAMEs, which is where my code-server instance is running.

I too disabled all auth except for what's built-in to the container and got the same results. I also put my ssl certificate into the .ssh folder, same results. Not sure what else to try

[Marnalas]

I use Cloudflare for free too but I don't use a wildcard CNAME. That's why I get to have it proxied. But I also tried the "DNS only" option and, like you, it didn't work any better.

"I also put my ssl certificate into the .ssh folder, same results". It's not the ssl certificate that's supposed to go into the .ssh folder, it's the private part of the SSH key set in your github account (https://docs.github.com/en/authentication/connecting-to-github-with-ssh).
That being said I've done that when I first set up the container (I prefer this authentication to the PAT one) and it didn't work either.

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[aasimenator]

I have the same issue, as per the documentation, I've generated the /config/.ssh/id_rsa & /config/.ssh/id_rsa.pub
/config/.ssh/id_rsa.pub was copied over to my GitHub > Settings > SSH and GPG keys > New SSH key

then I ran git config --global user.name "myusername" & git config --global user.email "myemailaddress"

then clicking on anything like "Publish to Github" takes me to an OAuth screen, and when I click continue I get an "Oh no! An error occurred!

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[aptalca]

This should be fixed by upstream now. Feel free to reopen or report to them if not.