After upgrade to dfx 0.9.2, can not deploy to existing motoko canister

After upgrading dfx from 0.8.4 to 0.9.2, suddenly I am not able to deploy to an existing motoko canister.
The frontend deploys fine, but I am getting this error on a motoko canister:

Error: The replica returned an HTTP Error: Http Error: status 403 Forbidden, content type "application/cbor", content: Requested canister rejected the message

After downgrading back to dfx version 0.8.4, everything works fine.

1 Like

I’m also on 0.9.2 and got this error. I put in a lengthy reply to a very old topic 403 forbidden error when running command "dfx identity --network ic deploy-wallet <canister-identifer>" - #37 by augchan42 but maybe the issue is a bug with 0.9.2?

1 Like

Oh boy join the club!
8 to 9 ugrade has breaking change
I didn’t see notes untill to late

This is due to recent changes in DFX (since version 0.9.0).

Some explanations :

  • When using dfx you are talking to the IC using an identity, you can check the principal associated with this identity with dfx identity get-principal.

    You also have a cycle-wallet (which is a canister as only canisters can hold cycles), you can check the canister id of the canister that acts as your cycle wallet using dfx identity --network ic get-wallet. The cycle wallet is used to deploy canisters as you need to spend cycles and only the wallet can do it for you :money_with_wings: so in reality when you run dfx deploy you are asking the cycle wallet to deploy for you.

  • All canisters have controllers, the controllers are the only people authorized to redeploy a new code on an existing canisters.

  • In older versions of dfx (< 0.9.0) : at the moment a new canister was created it was only possible to assign one controller and by default it was the cycle wallet (since it’s him that deployed the canister).

    All further calls to the deployed canister using dfx were forwarded to the cycle wallet by default because it was the default controller.
    If you wanted to use your identity directly without proxying to the cycle wallet you needed to add the --no-wallet flag to all commands.

  • In new versions of dfx (>= 0.9.0) : it is now possible to assign multiple controllers to a deployed canister, so both your cycle wallet and your identity are automatically assigned as controller when you deploy a fresh canister.
    There is no need to forward calls using the cycle wallet anymore so the --no-wallet flag has disappeared.

To fix you issue, you need to upgrade to DFX 0.9.2 and add your identity as controller, you’ll then be able to redeploy.
You can do so by running the following commands.

dfx wallet --network ic upgrade
dfx canister --network ic --wallet "$(dfx identity --network ic get-wallet)" update-settings --all --add-controller "$(dfx identity get-principal)" 

More informations :


The new version is simpler for people who are onboarding now, but we’re sorry for the inconvenience in the upgrade!

Thanks for that detailed explanation. The fix worked.

i ran the install script to 9.2 before updating 8.0 wallets. so i think I out of luck :frowning:

[email protected]:~/ICP/ic-avatar$ dfx wallet --network ic upgrade
Error: Could not find wallet for “admin” on “ic” network.
[email protected]:~/ICP/ic-avatar$

A bunch of new people for the upcoming bootcamp (myself included) ran into this same issue… so seems there’s still something non-intuitive going on.

This helps my friend to fix the issue for the boot camp requirement. Many thanks!