Fix VS Code "Error: XHR failed" When Installing or Searching Extensions

TL;DR

VS Code can't reach marketplace.visualstudio.com or vscode.cdn.azure.cn. Fastest fixes:

• Set your proxy in VS Code settings: "http.proxy": "http://your-proxy:port"
• Or disable proxy detection entirely: "http.proxySupport": "off"
• Set "http.proxyStrictSSL": false if behind SSL inspection

What Triggers This Error

Hit Install on any extension and VS Code fires an XHR request to the Visual Studio Marketplace. Anything that blocks that request — a misconfigured proxy, a firewall rule, an intercepted TLS handshake — produces the same cryptic error:

Error: XHR failed

Common root causes:

• Corporate proxy not configured: VS Code doesn't auto-inherit your system proxy — especially on macOS and Linux, where there's no unified system-proxy API.
• SSL/TLS interception: Your company's firewall decrypts HTTPS traffic with a custom CA. VS Code doesn't trust that CA by default.
• VPN blocking outbound traffic: Some split-tunnel VPN configs block marketplace domains entirely.
• IPv6 resolution issues: VS Code resolves to an IPv6 address your network doesn't route.
• Antivirus or firewall: Third-party security software blocks VS Code's network calls.

Fix 1: Configure Proxy in VS Code Settings

Open your user settings JSON (Ctrl+Shift+P → Preferences: Open User Settings (JSON)) and add:

{
  "http.proxy": "http://proxy.yourcompany.com:8080",
  "http.proxyStrictSSL": false
}

If your proxy requires authentication:

{
  "http.proxy": "http://username:password@proxy.yourcompany.com:8080",
  "http.proxyStrictSSL": false
}

Prefer not to put credentials in settings.json? Set the proxy via environment variables before launching VS Code instead:

# Linux / macOS
export HTTPS_PROXY=http://proxy.yourcompany.com:8080
export HTTP_PROXY=http://proxy.yourcompany.com:8080
code .

:: Windows Command Prompt
set HTTPS_PROXY=http://proxy.yourcompany.com:8080
set HTTP_PROXY=http://proxy.yourcompany.com:8080
code .

Fix 2: Turn Off Proxy Auto-Detection

VS Code sometimes mis-detects a proxy — this happens often when switching between office and home networks. Disable auto-detection to force direct connections:

{
  "http.proxySupport": "off"
}

Useful when you're not behind a proxy but VS Code thinks you are.

Fix 3: Trust a Custom CA Certificate (SSL Inspection)

Tools like Zscaler, Cisco Umbrella, and Forcepoint do deep packet inspection. They replace the marketplace's TLS certificate with one signed by your company's internal CA — and VS Code rejects it because that CA isn't in its trust store.

Step 1: Export your company CA certificate as a .pem file. Ask your IT team, or extract it from your browser's certificate store.

Step 2: The quick workaround is to disable strict SSL:

{
  "http.proxyStrictSSL": false
}

Step 3: For a fix that keeps certificate verification intact, use the NODE_EXTRA_CA_CERTS environment variable instead:

# Linux / macOS (~/.bashrc or ~/.zshrc)
export NODE_EXTRA_CA_CERTS=/path/to/company-ca.pem

# Windows (System Environment Variables)
NODE_EXTRA_CA_CERTS=C:\certs\company-ca.pem

Restart VS Code after setting the variable. This scopes the trust to your CA only — SSL verification stays on everywhere else.

Fix 4: Check DNS and Network Reachability

Before adjusting VS Code settings, confirm the marketplace is actually reachable from your machine:

# Test DNS resolution
nslookup marketplace.visualstudio.com

# Test HTTPS connectivity
curl -v https://marketplace.visualstudio.com/_apis/public/gallery/extensionquery

If DNS fails, try a public resolver to isolate whether it's your corporate DNS causing the block:

# Google DNS
nslookup marketplace.visualstudio.com 8.8.8.8

# Cloudflare DNS
nslookup marketplace.visualstudio.com 1.1.1.1

If curl hangs or returns a connection error, it's network-level. Your VPN, firewall, or proxy is blocking the request. Ask your network team to whitelist these domains:

• marketplace.visualstudio.com
• *.vscode.cdn.azure.cn (China mirror)
• vscode.blob.core.windows.net
• az764295.vo.msecnd.net (CDN)

If you need to verify that your network can reach specific CIDR ranges or subnets associated with Azure CDN endpoints, the Subnet Calculator on ToolCraft can help you calculate and validate IP ranges without uploading anything.

Fix 5: Install Extensions Manually (VSIX)

Sometimes the network fix has to wait — IT ticket, VPN approval, whatever. VSIX packages let you install extensions offline in the meantime.

Step 1: On a machine that has marketplace access, download the .vsix file from the VS Code Marketplace. You can also construct the download URL directly:

https://marketplace.visualstudio.com/_apis/public/gallery/publishers/{publisher}/vsextensions/{extension}/{version}/vspackage

Step 2: Copy the file to your restricted machine, then install it:

# Via command palette
Ctrl+Shift+P → "Extensions: Install from VSIX..."

# Or via CLI
code --install-extension path/to/extension.vsix

Verification

Test the fix before closing your terminal:

• Open Extensions panel (Ctrl+Shift+X)
• Search for a popular extension like ESLint or Prettier
• Results should appear within 2–3 seconds
• Click Install on any extension — it should download without an error popup

Still failing? Pull up VS Code's network log to see exactly which request is blocked:

Help → Toggle Developer Tools → Console tab

The URL and HTTP status code on any failed request will tell you precisely what's being dropped.

Quick Reference

// settings.json — paste whichever block applies

// Behind a corporate proxy
{
  "http.proxy": "http://proxy.example.com:8080",
  "http.proxyStrictSSL": false
}

// No proxy (direct connection)
{
  "http.proxySupport": "off"
}

// Trust company CA cert via env var
// NODE_EXTRA_CA_CERTS=/path/to/ca.pem (set before launching VS Code)