Environment
- OS: Windows 11 Enterprise (corp-managed)
- VS Code: latest
- Extension: ms-azuretools.vscode-azureappservice (latest)
- Network: corporate HTTPS-intercepting proxy with custom CA cert
Description
On corp Windows machines behind an HTTPS-intercepting proxy, the Azure App Service extension fails silently when performing operations that require outbound HTTPS: listing subscriptions, listing app services, deploying ZIPs, streaming logs. The extension's tree view shows a spinner that never resolves, or a generic 'Failed to list resources' error with no indication that proxy configuration is at fault.
Two specific gaps:
-
No proxy configuration surface: The extension does not expose any UI or setting to configure a proxy for its Azure SDK calls. VS Code's http.proxy setting is not documented as supported or unsupported.
-
No corp CA certificate guidance: When the intercepting proxy presents a certificate signed by an internal CA, the extension's Azure SDK HTTP client raises UNABLE_TO_GET_ISSUER_CERT_LOCALLY. There is no documentation on how to trust the corp CA for extension use (e.g. NODE_EXTRA_CA_CERTS, VS Code's http.systemCertificates).
Steps to Reproduce
- Corp Windows machine with HTTPS proxy (HTTPS_PROXY set, corp CA in Windows cert store)
- Open the Azure App Service extension tree view
- Observe: subscription list fails to load; output channel shows TLS or network error with no proxy context
Expected vs Actual Behavior
Expected: Extension respects http.proxy VS Code setting (or HTTPS_PROXY env var) and trusts the OS/VS Code certificate store; error messages identify proxy/cert misconfiguration specifically.
Actual: Silent failure or opaque TLS error; no guidance for corp network users.
Additional Context
This is a documentation and UX gap. A small addition to the README and improved error messaging (detecting CERT_ or ECONNREFUSED errors and suggesting proxy config steps) would substantially reduce support burden for enterprise users.
Environment
Description
On corp Windows machines behind an HTTPS-intercepting proxy, the Azure App Service extension fails silently when performing operations that require outbound HTTPS: listing subscriptions, listing app services, deploying ZIPs, streaming logs. The extension's tree view shows a spinner that never resolves, or a generic 'Failed to list resources' error with no indication that proxy configuration is at fault.
Two specific gaps:
No proxy configuration surface: The extension does not expose any UI or setting to configure a proxy for its Azure SDK calls. VS Code's http.proxy setting is not documented as supported or unsupported.
No corp CA certificate guidance: When the intercepting proxy presents a certificate signed by an internal CA, the extension's Azure SDK HTTP client raises UNABLE_TO_GET_ISSUER_CERT_LOCALLY. There is no documentation on how to trust the corp CA for extension use (e.g. NODE_EXTRA_CA_CERTS, VS Code's http.systemCertificates).
Steps to Reproduce
Expected vs Actual Behavior
Expected: Extension respects http.proxy VS Code setting (or HTTPS_PROXY env var) and trusts the OS/VS Code certificate store; error messages identify proxy/cert misconfiguration specifically.
Actual: Silent failure or opaque TLS error; no guidance for corp network users.
Additional Context
This is a documentation and UX gap. A small addition to the README and improved error messaging (detecting CERT_ or ECONNREFUSED errors and suggesting proxy config steps) would substantially reduce support burden for enterprise users.