Last Monday, Internet Identity was malfunctioning for about half an hour after an upgrade. The cause was a Content-Security-Policy issue that prevented browsers from making calls to the IC. The team rolled back the upgrade after 34 minutes and the fix was ready almost immediately. The team spent mos…

Thank you for the detailed post it helps us understand how dfinity teams are working internally. I have one question tho, do you have a traffic switching when you deploy new code to production? Like you deploy first to 1% of the users and observe the performance then gradually increase till 100% or…

Thank you @nmattia Have you thought about deploying a test-internet-identity canister with another principal to mainnet? This could make it easier to test in production.

Great question! We could definitely do that, at least for the frontend code; we’ll definitely look into this in the next few weeks. Unfortunately we don’t really have a way yet of “observing performance” since we don’t even have “access to the machine” in the typical sense.

That’s a great idea! And I must be terrible at expressing myself, because that’s exactly what we did, if I understand you correctly :slight_smile: Second, we now read the canister ID from the canister itself – as opposed to baking it in the frontend – meaning the team can test the official Wasm c…

Oh, sorry, its my bad (english lol) Well, it’s good that the thoughts coincided, thank you! :slight_smile:

[image] nmattia: This happened because the upgrade included an update of the agent-js library which, for efficiency reasons, I believe it’s for security reasons. As far as I understand, the insecure /api pass through in the service worker is a (hopefully mostly theoretical) attack vector, and…

[image] nmattia: meaning the team can test the official Wasm canister code in a different canister If these tests should work end-to-end, including logging in, we need support for Canister Signature from delegated (non-root) subnets. Is that finally in the pipeline then (or maybe already pres…

Yup, to clarify, we only ran limited testing on the mainnet canister clone, namely loading of assets and basic auth flow (key creation) which was enough to make sure this particular CSP issue was gone!

My understanding is that the Boundary node supports /api on certified domains because, well, it did originally and we didn’t see the problem with that in time. We want to remove the redirect on the boundary node eventually for security reasons. This would break existing agents, so agent-js was upda…

Internet Identity Incident Retrospective - January 31, 2022

Developers

nmattia February 7, 2022, 10:15am 10

So as far as I can tell the boundary node performs the redirect anyway – for security reasons. So I’m assuming the change in agent-js was made for performance reasons, to avoid that redirect.

Topic		Replies	Views
Local internet identity failure Developers	24	1533	December 30, 2023
Internet Identity id.ai/#authorize returning 503 / corrupted JS from some boundary nodes internet-identity	13	149	February 19, 2026
Fixed Internet Identity Issue With Google Sign In: Proposals 138263, 138262 and 138188 internet-identity	0	22	August 29, 2025
SOS. Critical problem with ICPSwap! Developers	163	8785	December 15, 2024
Internet Identity issue: Error: Failed to authenticate request internet-identity	5	978	September 29, 2022

Internet Identity Incident Retrospective - January 31, 2022

Related topics