After upgrading dfx from 0.8.4 to 0.9.2, suddenly I am not able to deploy to an existing motoko canister.
The frontend deploys fine, but I am getting this error on a motoko canister:
Error: The replica returned an HTTP Error: Http Error: status 403 Forbidden, content type "application/cbor", content: Requested canister rejected the message
After downgrading back to dfx version 0.8.4, everything works fine.
I’m also on 0.9.2 and got this error. I put in a lengthy reply to a very old topic 403 forbidden error when running command "dfx identity --network ic deploy-wallet <canister-identifer>" - #37 by augchan42 but maybe the issue is a bug with 0.9.2?
Oh boy join the club!
8 to 9 ugrade has breaking change
I didn’t see notes untill to late
This is due to recent changes in DFX (since version 0.9.0).
Some explanations :
When using dfx you are talking to the IC using an identity, you can check the principal associated with this identity with dfx identity get-principal.
You also have a cycle-wallet (which is a canister as only canisters can hold cycles), you can check the canister id of the canister that acts as your cycle wallet using dfx identity --network ic get-wallet. The cycle wallet is used to deploy canisters as you need to spend cycles and only the wallet can do it for you 
so in reality when you run dfx deploy you are asking the cycle wallet to deploy for you.
All canisters have controllers, the controllers are the only people authorized to redeploy a new code on an existing canisters.
In older versions of dfx (< 0.9.0) : at the moment a new canister was created it was only possible to assign one controller and by default it was the cycle wallet (since it’s him that deployed the canister).
All further calls to the deployed canister using dfx were forwarded to the cycle wallet by default because it was the default controller.
If you wanted to use your identity directly without proxying to the cycle wallet you needed to add the --no-wallet flag to all commands.
In new versions of dfx (>= 0.9.0) : it is now possible to assign multiple controllers to a deployed canister, so both your cycle wallet and your identity are automatically assigned as controller when you deploy a fresh canister.
There is no need to forward calls using the cycle wallet anymore so the --no-wallet flag has disappeared.
To fix you issue, you need to upgrade to DFX 0.9.2 and add your identity as controller, you’ll then be able to redeploy.
You can do so by running the following commands.
dfx wallet --network ic upgrade
dfx canister --network ic --wallet "$(dfx identity --network ic get-wallet)" update-settings --all --add-controller "$(dfx identity get-principal)"
More informations :
The new version is simpler for people who are onboarding now, but we’re sorry for the inconvenience in the upgrade!
Thanks for that detailed explanation. The fix worked.
i ran the install script to 9.2 before updating 8.0 wallets. so i think I out of luck 
opa@zbox:~/ICP/ic-avatar$ dfx wallet --network ic upgrade
Error: Could not find wallet for “admin” on “ic” network.
opa@zbox:~/ICP/ic-avatar$
A bunch of new people for the upcoming bootcamp (myself included) ran into this same issue… so seems there’s still something non-intuitive going on.
This helps my friend to fix the issue for the boot camp requirement. Many thanks!
@Seb @kpeacock my principal is a controller however, I am getting the following:
Error: The invocation to the wallet call forward method failed with the error: An error happened during the call: 5: Only the controllers of the canister gggww-bbaaa-aaaai-yyi6q-vai can control it.
after running:
dfx wallet --network ic upgrade
and
dfx canister --network ic --wallet "$(dfx identity --network ic get-wallet)" update-settings --all --add-controller "$(dfx identity get-principal)"
any ideas?
@bundubuduri is your wallet a controller of the canister in question? If you let the wallet do the call and your wallet is not a controller, you should get that error message.
To add your wallet as a controller, you’d have to run dfx canister --network ic update-settings --all --add-controller "$(dfx identity --network ic get-wallet)"
@Severin Thanks for that, unfortunately it did not work. I get the following:
Error: The replica returned an HTTP Error: Http Error: status 403 Forbidden, content type "application/cbor", content: Only controllers of canister gggww-bbaaa-aaaai-yyi6q-vai can call ic00 method canister_status
Added my principal to be a controller and authorized my principal as well so:
dfx wallet --network ic controllers is my principal
dfx wallet --network ic custodians is my principal
I am able to upgrade the wallet wasm and aslo get the balance.
So if you do dfx canister --network ic info <canister> on the canister you’re trying to manage, is your wallet listed as a controller?
Btw, possible error source: do you have the canister we’re talking about configured in dfx.json? If not, the --all flag will not pick it up, and you have to do the calls manually to the right IDs.
Its not listed as a controller. I do have the canister in my dfx.json though.
Update for posteriority: we resolved the issue over DMs, problem was a wrong wallet somehow sneaking into the configured wallet while going through the cycles faucet.
@Severin Thanks alot for your help. For others that may find themselves in the same situation: Somehow I was working with 1 canister and 2 different wallets. I might have missed a step or authorized the wrong wallet for the canister that I was working with.
The fix is simple:
dfx identity --network ic set-wallet <Wallet ID>
dfx wallet --network ic upgrade dfx canister --network ic --wallet "$(dfx identity --network ic get-wallet)" update-settings --all --add-controller "$(dfx identity get-principal)"
Small correction: it’s canister_ids.json