VS in a credentials request dead-loop when trying to access NuGet feed

[weitzhandler]

Describe the bug

This happens whenever I'm opening NuGet manager for a solution where the Labs feed is one of its sources.

The credentials screen appears in a continuous dead-loop that blocks any input in VS and appears again and again essentially locking out the IDE for good (till restart).

Steps to reproduce

1. Add the labs feed to a project
2. Right-click the solution and click Manage NuGet packages for solution
3. The following modal dialog shows up (blocking any other input from IDE) asking for credentials. When clicking Continue the modal shows up again continuously:

   NuGet (CommunityToolkit-Labs needs your credentials. Use one of these accounts

Expected behavior

Should not ask for credentials.

Screenshots

No response

Code Platform

• UWP
• WinAppSDK / WinUI 3
• Web Assembly (WASM)
• Android
• iOS
• MacOS
• Linux / GTK

Windows Build Number

Windows 11 21H2 (Build 22621)

Other Windows Build number

No response

App minimum and target SDK version

Windows 10, version 1809 (Build 17763)

Other SDK version

No response

Visual Studio Version

17.13.5

Visual Studio Build Number

No response

Device form factor

No response

Additional context

No response

Help us help you

[weitzhandler]

Workaround:

For some odd reason after removing the feed from VS settings and adding it manually into the project, the issue is gone (added the following NuGet.config file into the dependent project)

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <packageSources>
    <add key="CommunityToolkit-Labs" value="https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-Labs/nuget/v3/index.json" />
  </packageSources>
</configuration>

[beeradmoore]

Interestingly mine was only ever added as a nuget.config in my project, but that option still does show up in Tools > Options. I had previously gone to this menu to then disable them which doesn't seem to impact the nuget.config itself, so it must be changing something in a .user or other file.

Going back to the nuget options and re-enabling them and the problem does not appear to have come back. Maybe it was a blip in the nuget feed reporting unauthorised errors that later got cleaned up?

EDIT: Nevermind, it came back.

[weitzhandler]

Try to clear the NuGet cache after you've disabled the option in the VS NuGet options then try to rebuild.

[weitzhandler]

Anyway I still can't build the project

warning NU1900: Error occurred while getting package vulnerability data: Response status code does not indicate success: 401 (Unauthorized).

[michael-hawker]

@weitzhandler this is going to be an issue with DevOps itself, VS, and/or NuGet, not specific to the Toolkit Labs feed.

We've seen issues in the past where DevOps tries to pre-emptively authenticate if you have logged into a DevOps instance before with cached credentials, but the feed is unauthenticated. In the browser, you can generally open it in a InPrivate tab without issue. I haven't seen this come up in VS before though, so this seems new.

Since you see the error in the console too, I'd start by opening an issue on the NuGet repo?

[beeradmoore]

@michael-hawker , I think the issue is that https://pkgs.dev.azure.com/dotnet/696bc9fd-f160-4e97-a1bd-7cbbb3b58f66/_packaging/9c12ba9d-e4eb-4290-9266-e0fb1a871009/nuget/v3/vulnerabilities/index.json which is referenced in https://pkgs.dev.azure.com/dotnet/CommunityToolkit/_packaging/CommunityToolkit-Labs/nuget/v3/index.json requires a login.

If that isn't expected, it would be some Azure config change in the feed.

EDIT: From the urls linked in the main feed. I don't know nuget spec or what are meant to work or not.

Name	Works
PackagePublish/2.0.0	✅
LegacyGallery/2.0.0	✅
RegistrationsBaseUrl/3.0.0-beta	404
RegistrationsBaseUrl/3.6.0	404
RegistrationsBaseUrl/Versioned	404
SearchQueryService/3.0.0-beta	✅
PackageBaseAddress/3.0.0	404
VulnerabilityInfo/6.7.0	❌

EDIT 2:

When I try login via the web form it presents I get the error. Hopefully this helpful to find the right person to ping.

Selected user account does not exist in tenant '.NET Foundation' and cannot access the application '499b84ac-1321-427f-aa17-267ca6975798' in that tenant. The account needs to be added as an external user in the tenant first. Please use a different account.

MainLatest feed also hits up a different vulnerabilities/index.json but results in the same unauthorised.

[michael-hawker]

@beeradmoore this is very helpful! Thank you. I didn't realize there was all these internals. I wonder if something in the base DevOps instance (which is managed by the .NET Foundation for us) changed underneath. I have an inquiry out in the maintainers chat.

I don't see any settings that we have (at least not exposed through the DevOps portal) that would enable us to configure any of that.