An Internet-Identity-principal is tied to a domain-name?

Developers Programs & Applications
2

There are two independent aspects here worth mentioning:

  • WebAuth devices (finger print, yubikeys) are bound to the origin (i.e. host name) of the site you are logging into In this case https://identity.ic0.app. This is a property of WebAuthentication, and nothing we can change easily. If we move the Internet Identity from https://identity.ic0.app to another hostname, there will have to be a manual migration protocol (e.g. using a recovery seed phrase), but you can keep the User Number just fine.

  • The identity handed out by the Internet Identity is tied to the hostname. It is a deliberate decision in the design to authorize web application (which are identified by hostname) rather than by canister. This is matches the security model of the web in many ways, is more suitable because it’s really web applications (i.e. frontends) talking to each other here. And it’s not like a web application will always have a canister behind them – they may be hosted outside the IC, and there is no reason to not allow the Internet Identity to be used in that case, or there may have multiple canisters associated with this web application, or a single canister may host many web applications (dispatching on the Host: header, once we have nice-names-to-canisters).

    Yes, this is causing extra headaches when changing hostnames – but it avoids headaches when changing the hosting backend. So it’s a trade off.

4 Likes