Unable to install / update extensions

[JakeMoe]

Does this issue occur when all extensions are disabled?: Yes

• VS Code Version: 1.69.1
• OS Version: Windows 11 Enterprise 21H2 build 22000.795

Steps to Reproduce:

1. Open Visual Studio Code
2. Try to install or update modules
3. Get error: "Error while installing '' extension. Please check the log for more details.
4. Log shows:

[2022-07-18 10:24:30.149] [renderer1] [error] RequestService#request (browser) - error https://ms-vscode.gallerycdn.azure.cn/extensions/ms-vscode/powershell/2022.6.3/1656633380437/Microsoft.VisualStudio.Code.Manifest {}
[2022-07-18 10:24:30.834] [renderer1] [error] RequestService#request (browser) - error https://ms-vscode.gallerycdn.azure.cn/extensions/ms-vscode/powershell/2022.6.3/1656633380437/Microsoft.VisualStudio.Code.Manifest {}
[2022-07-18 10:24:31.889] [renderer1] [error] RequestService#request (browser) - error https://ms-vscode.gallery.vsassets.io/_apis/public/gallery/publisher/ms-vscode/extension/PowerShell/2022.6.3/assetbyname/Microsoft.VisualStudio.Code.Manifest {}
[2022-07-18 10:24:31.895] [renderer1] [error] Error: XHR failed
    at XMLHttpRequest.m.onerror (vscode-file://vscode-app/c:/Users/JohnMoe/AppData/Local/Programs/Microsoft%20VS%20Code/resources/app/out/vs/workbench/workbench.desktop.main.js:70:9062)
[2022-07-18 10:24:31.898] [renderer1] [error] XHR failed: Error: XHR failed
    at XMLHttpRequest.m.onerror (vscode-file://vscode-app/c:/Users/JohnMoe/AppData/Local/Programs/Microsoft%20VS%20Code/resources/app/out/vs/workbench/workbench.desktop.main.js:70:9062)
[2022-07-18 10:24:32.342] [renderer1] [error] RequestService#request (browser) - error https://ms-vscode.gallery.vsassets.io/_apis/public/gallery/publisher/ms-vscode/extension/PowerShell/2022.6.3/assetbyname/Microsoft.VisualStudio.Code.Manifest {}

More info and troubleshooting:

I'm guessing my issue is that our company geoblocks China, and I can see our SASE blocking the connections to azure.cn in the logs. Those third and fourth links (to vsassets.io) should work though; it opens fine in a browser on the same system under the same user, and I don't see it being blocked in our SASE logs. My guess is that the first two URLs fail, and then it tries the third and fourth as fallbacks, but it should have succeeded, unless the third / fourth downloads are somehow dependent on the first two. Can someone tell me if this is correct?

If I temporarily disable our SASE client, extensions install and update successfully. This works for me (I'm a sysadmin, so I can temp disable the client for testing), but won't work for our users. And I'd rather not add the exclusion for China if I don't have to. I found some info about these domains here: https://docs.microsoft.com/en-us/azure/devops/organizations/security/allow-list-ip-url I know that's not about VS Code specifically, but I presume the CDN info is similar. It seems to say that most of the world should be using *.vsassets.io, but in China it uses *.azure.cn. I'm in Australia, so I'm not sure why it's trying azure.cn first? Our SASE service exits in Melbourne, so that should be the location used for CDN selection?

[sandy081]

cc @prashantvc

[madhurivadaligithub]

This is being tracked at Customer support tickets and we are discussing this customer through our support channel already

[towry]

2022-11-22 20:40:46.050 [error] RequestService#request (browser) - error https://bingsettingssearch.trafficmanager.net/api/Search {}
2022-11-22 20:40:46.050 [info] Setting search error: XHR timeout: 5000ms
2022-11-22 20:41:20.295 [error] Download: XHR timeout: undefinedms
    at pt.download (vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/sharedProcess/sharedProcessMain.js:37:112777)
    at async V.doRun (vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/sharedProcess/sharedProcessMain.js:89:199434)
2022-11-22 20:41:20.327 [error] XHR timeout: undefinedms: Download: XHR timeout: undefinedms
    at pt.download (vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/sharedProcess/sharedProcessMain.js:37:112777)
    at async V.doRun (vscode-file://vscode-app/Applications/Visual%20Studio%20Code.app/Contents/Resources/app/out/vs/code/electron-browser/sharedProcess/sharedProcessMain.js:89:199434)

[JakeMoe]

I worked with Microsoft Support on this; we found from the network requests that VS Code was trying the correct (non-China) endpoints. I'm guessing it was trying China as a fallback when it couldn't reach the correct one, which is what I saw being blocked. Most likely, it would have been our network security client interfering in some other way, such as SSL inspection. As I left that company, I never got any further with this than determining the fault didn't appear to be coming from VS Code.