serve-web throwing error "Unauthorized client refused"

[JtMotoX]

Does this issue occur when all extensions are disabled?: Yes/No

• VS Code Version: Insiders - code-cli 1.82.0 (commit a0377f0)
• OS Version: AlmaLinux release 8.8 (Sapphire Caracal)

Related to #191014

Steps to Reproduce:

1. Download the latest insiders code cli
2. Run ./code-insiders serve-web --host 0.0.0.0
3. Navigate to the URL provided in the cli output (including the tkn) but replace 0.0.0.0 with the server local hostname.

An unexpected error occurred that requires a reload of this page.
The workbench failed to connect to the server (Error: Connection error: Unauthorized client refused)

> ./code-insiders serve-web --host 0.0.0.0
...
[2023-08-24 20:28:20] info Downloading server a0377f0c51dbb2d3188565cdf35e89929f864e65
[2023-08-24 20:28:25] info Starting server a0377f0c51dbb2d3188565cdf35e89929f864e65
...
[2023-08-24 20:28:26] info [a0377f0 stdout]: [20:28:26] Extension host agent started.
[2023-08-24 20:28:26] info [a0377f0 stdout]: [20:28:26] Started initializing default profile extensions in extensions installation folder. file:///Users/me/.vscode-server-insiders/extensions
[2023-08-24 20:28:26] info [a0377f0 stdout]: [20:28:26] Completed initializing default profile extensions in extensions installation folder. file:///Users/me/.vscode-server-insiders/extensions
[2023-08-24 20:28:32] info [a0377f0 stderr]: [20:28:32] [<unknown>][2cfa09f7] Unauthorized client refused.
[2023-08-24 20:28:33] info [a0377f0 stderr]: [20:28:33] [<unknown>][bb7e75bf] Unauthorized client refused.
[2023-08-24 20:28:33] info [a0377f0 stderr]: [20:28:33] [<unknown>][59bb9968] Unauthorized client refused.
[2023-08-24 20:28:33] info [a0377f0 stderr]: [20:28:33] [<unknown>][355c0013] Unauthorized client refused.
[2023-08-24 20:28:33] info [a0377f0 stderr]: [20:28:33] [<unknown>][2c13483e] Unauthorized client refused.
[2023-08-24 20:28:34] info [a0377f0 stderr]: [20:28:34] [<unknown>][4be2c924] Unauthorized client refused.
[2023-08-24 20:28:34] info [a0377f0 stderr]: [20:28:34] [<unknown>][8366c9b6] Unauthorized client refused.
[2023-08-24 20:28:34] info [a0377f0 stderr]: [20:28:34] [<unknown>][ab2b3ce6] Unauthorized client refused.
[2023-08-24 20:28:34] info [a0377f0 stderr]: [20:28:34] [<unknown>][3bad50da] Unauthorized client refused.
[2023-08-24 20:28:34] info [a0377f0 stderr]: [20:28:34] [<unknown>][f0f7d760] Unauthorized client refused.
[2023-08-24 20:28:37] info [a0377f0 stderr]: File not found: /Users/me/.vscode-insiders/cli/serve-web/a0377f0c51dbb2d3188565cdf35e89929f864e65/extensions/git-base/dist/browser/extension.js
[2023-08-24 20:28:37] info [a0377f0 stderr]: File not found: /Users/me/.vscode-insiders/cli/serve-web/a0377f0c51dbb2d3188565cdf35e89929f864e65/extensions/merge-conflict/dist/browser/mergeConflictMain.js

[connor4312]

I'm not able to reproduce this. Can you grab a screenshare so I can see I'm doing the right steps? http://gifcap.dev/ is useful

[JtMotoX]

I am not able to provide a screenshare. Keep in mind that if you are navigating via localhost or 127.0.0.1 then you will not be able to replicate this issue. I have been able to replicate this on multiple servers (both Alma and Ubuntu) and on completely different networks, with completely different browsers.

Here are the steps to replicate.

On remote system:

rm -rf ~/.vscode*insiders
rm -f ./code-insiders
wget 'https://code.visualstudio.com/sha/download?build=insider&os=cli-alpine-x64' -O - | tar -xvz
./code-insiders serve-web --host 0.0.0.0

*
* Visual Studio Code Server
*
* By using the software, you agree to
* the Visual Studio Code Server License Terms (https://aka.ms/vscode-server-license) and
* the Microsoft Privacy Statement (https://privacy.microsoft.com/en-US/privacystatement).
*
Web UI available at http://0.0.0.0:8000?tkn=82afe424-c161-4c1c-b4cf-71d2f04f9fb5

On local system:
Open your browser and navigate to the url provided in the output from remote system commands above, replacing the 0.0.0.0 with the local ip of your remote system (e.g. http://192.168.1.11:8000?tkn=82afe424-c161-4c1c-b4cf-71d2f04f9fb5)

[connor4312]

Ah, I see. That is because the server connection depends on the web cryptography API which, when not on localhost, is required to be served from a secure context. Unfortunately this is a browser limitation.

Currently the CLI does not support running serve-web with a TLS certificate, requiring an additional proxy layer such as Caddy, though I think adding support for it would be quite sensible.

[JtMotoX]

Ok, that makes sense. So maybe some kind of documentation or error message stating that http is not supported would clear that up.

I just put a reverse proxy with a valid TLS certificate in front of it and it is working. Thanks 👍

[connor4312]

Added to the release notes