microsoft / microsoft/vscode

SSH askpass shows yes/no host-fingerprint prompt instead of PIN input for FIDO2/security-key authentication

Open
#326,324 0 comments 2 reactions 1 assignee Claimed by @lszomoru View on GitHub
Dominant language
TypeScript
Stars
193k
Forks
42.4k
PR merge metrics
PR metrics pending

Description

Does this issue occur when all extensions are disabled?: Yes (this is a bug in the built-in `git` extension itself, which `--disable-extensions` does not disable)

- VS Code Version: 1.129.0 (commit 125df4672b8a6a34975303c6b0baa124e560a4f7, x64), built-in Git extension v10.0.0
- OS Version: Linux (CachyOS, kernel 7.1.3-2-cachyos)

Steps to Reproduce:

1. Configure an SSH remote authenticated with an `ed25519-sk`/`ecdsa-sk` (FIDO2 security key) registered with `verify-required` (PIN + touch), with `git.useIntegratedAskPass` left at its default (`true`).
2. Trigger a `git fetch`/`git push` in the Source Control panel that requires signing with that key.
3. OpenSSH's `ssh-sk-helper` prompts for the key's PIN with the text `Enter PIN for authenticator:`.
4. VS Code shows a yes/no "Are you sure you want to continue connecting?" quick pick instead of a PIN input box (there is no way to enter a PIN), and authentication fails.

Root cause: in `extensions/git/dist/main.js`, `handleSSHAskpass()` only renders a text input box when the prompt matches `/passphrase/i`; every other prompt falls through to the yes/no "continue connecting" quick pick meant for host-key confirmation. OpenSSH's FIDO2 PIN prompt text ("Enter PIN for authenticator:") does not contain "passphrase", so it is misclassified.

Expected: a password-style input box should be shown for the PIN prompt, the same way it already works for `Enter passphrase for key ...` prompts.

Workaround: set `"git.useIntegratedAskPass": false` so the OS-level `SSH_ASKPASS` helper (e.g. `x11-ssh-askpass`) handles the prompt instead of VS Code's own UI.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.