NuGet list doesn't use v3 credentials for v2 list

[zarenner]

I believe that this bug was fixed in NuGet 3.3 as #1229, but was re-introduced in 3.4 and still exists in the latest nightly.

Repro:

1. Example nuget.config:

   <?xml version="1.0" encoding="utf-8"?>
   <configuration>
     <packageSources>
       <clear />
       <add key="zachtest" value="https://<authenticated_feed>/v3/index.json" protocolVersion="3" />
     </packageSources>
     <packageSourceCredentials>
       <zachtest>
         <add key="Username" value="MyUserName" />
         <add key="Password" value="[redacted]" />
       </zachtest>
     </packageSourceCredentials>
   </configuration>

2. Run “nuget list”

Expected behavior: NuGet re-uses the v3 credentials for v2 list
Actual behavior: NuGet prompts “Please provide credentials for: https://<authenticated_feed>/v2/”

Note that the bug does not occur when the credential provider is used. In fact, the credential provider is (correctly) only ever invoked once:

1.   For the v3 endpoint, if the service index has not been cached
   

2.   For the v2 endpoint, if the service index has been cached
   

List is the only command affected.

[boekabart]

+1

[damianh]

Experiencing same here with 3.4.4-rtm-final . I have no V2 sources registered.

nuget install doesn't prompt for credentials.

[damianh]

Bug remains in v3.5.0-rc1. cc @harikmenon @karann-msft

[damianh]

The account whose credentials we (securely) set up in TeamCity to connect to myget has been repeatedly getting locked out.

We have checked in versions of nuget.exe in our repositories to bootstrap the package restore and build process. Various repositories have upgraded the checked in nuget.exe to 3.4. It is my belief that this bug is causing the account lockout after a few CI builds.

I now have to recommend to my devs to stay with v3.3 until further notice :(

cc @maartenba

[maartenba]

@damianh That sucks :-( Do you have any request logs to share?

[nkolev92]

The work in NuGet/NuGet.Client#3273, might fix this issue thanks to @BlackGad.

We'd need to validate that first though.
The test to confirm this fix would need to be happen in
https://github.com/NuGet/NuGet.Client/blob/dev/test/NuGet.Clients.Tests/NuGet.CommandLine.Test/NuGetListCommandTest.cs.

We'd like need to change the mock server to watch for the auth headers.

[BlackGad]

See this comment