Home: Visual Studio not using packageCredentials from NuGetDefaults.config

[ygeelen-tb]

Visual Studio UI, Package Manager Console, NuGet.exe and dotnet.exe should not rely on the browser cache for Basic HTTP credentials when packageCredentials are configured in NuGetDefaults.config, they should be read from NuGetDefaults.config for each request/query instead.

We have configured multiple private nuget feeds using ProGet, which have the same hostname but different credentials for each URI.

<?xml version="1.0" encoding="utf-8"?> <configuration> <packageSources> <add key="TestFeed" value="http://mycompany.com/nuget/feed1" /> <add key="ReleaseFeed" value="http://mycompany.com/nuget/feed2" /> </packageSources> <packageSourceCredentials> <TestFeed> <add key="Username" value="user1" /> <add key="ClearTextPassword" value="..." /> </TestFeed> <ReleaseFeed> <add key="Username" value="user2" /> <add key="ClearTextPassword" value="..." /> </ReleaseFeed> </packageSourceCredentials> </configuration>

Visual Studio 2015 and now also Visual Studio 2017 tend to prompt for credentials in a dialog window often. I think this happens when you have not saved the credentials using your default browser for the domain of the feeds. (The feeds have a web interface with a login page.)

See also #4938

[ygeelen-tb]

@alpaix Can this be fixed in the next VS2017 update? The prompt window is driving us crazy..
It's more urgent for us than issue 4938, although that one isn't unimportant.

[ygeelen-tb]

@yishaigalatzer @dnfclas @emgarten
Can you please assign someone to fix this?

[ygeelen-tb]

VS 2015+2017, nuget.exe v4 and dotnet.exe certainly have this issue.

[ygeelen-tb]

@alpaix @emgarten @dnfclas @joelverhagen Anyone?

[alpaix]

@ygeelen-tb Thanks for reporting this issue. It's been added to our backlog. We'll consider resolving it in upcoming releases.

[emgarten]

@ygeelen-tb are you still able to repro this in the latest NuGet 4.4? If so would it be possible for you to help track down why these config files are not coming through?

[ygeelen-tb]

@emgarten Sure, I will do another test at home asap and keep you posted.
At the moment we configured a rule on our proxy server at work to add in the credentials in case they're misssing in the request, so I can't test it here anymore.. :-)

[ygeelen-tb]

@emgarten The first time I tried to access a feed I had to enter the credentials at the command line. All next attempts I didn't have to enter them ("using credentials from config" is printed at command line). But even when commenting out the config, it kept working.
Also I noticed the same authorization header is sent for all feeds, even though they have different credentials!
I doubt they are really read from the config.. I think they're read from the commandline and then cached somehow.

When testing using my local machine name in the Feed URL instead of localhost, I need to enter my credentials each time again? "using credentials from config" is not printed at command line.

Is NuGet.exe 4.4 being shipped with the latest version of Visual Studio already?

[emgarten]

Visual Studio 15.4 contains NuGet 4.4.0

Just to clarify, nuget.exe has never shipped as part of VS.

[mattwhetton]

Has this been resolved?

[ygeelen-tb]

No, still not.

[ygeelen-tb]

@emgarten Any news on this? It's been a plague for us for years now.

As mentioned by @alpaix in https://github.com/NuGet/Home/issues/4938 :
"The bug #2151 was fixed in 3.5/3.6 internal release with NuGet/NuGet.Client#607. As confirmed by the customer this regressed again in 4.0.0-rtm-2283."

[emgarten]

I'll take a look.

[emgarten]

NuGetDefaults.config does not support credentials. It was originally designed for enabling nuget.org by default across a machine, and it is not a normal NuGet.Config file.

Adding credentials to any other nuget.config file apart from nugetdefaults.config works fine for me and successfully reads the feed.

❌ This path does not support credentials:
C:\Program Files (x86)\NuGet\NuGetDefaults.config

✔️ To store credentials under program files put your nuget.config under: C:\Program Files (x86)\NuGet\Config\*.config
Example: C:\Program Files (x86)\NuGet\Config\MyFeed.config

I have verified that this is the same behavior as NuGet 2.8.6. This is not a regression for NuGetDefaults.config. Also after going through the docs I do not see any mention of support for credentials so I don't believe this has ever been expected to work.
https://docs.microsoft.com/en-us/nuget/consume-packages/configuring-nuget-behavior#nuget-defaults-file