Invalid Derivation Origin

[nolma]

I followed this guide: How to Deploy Your First Canister Smart Contract Using the NNS Dapp | by DFINITY | The Internet Computer Review | Medium for deploying a canister and was able to deploy 3 canisters successfully.

As part of my token deployment params, I marked my nns principal as being the owner of the token with a starting balance. I can see the balance is correct in the Candid UI.

I want to interact with the canister so I click login, expecting to be prompted to connect with my nns account.

Instead I get an Invalid Derivation Origin error:

Invalid Derivation Origin
"https://6japz-gyaaa-aaaag-accza-cai.raw.icp0.io" is not a valid derivation origin for "https://a4gq6-oaaaa-aaaab-qaa4q-cai.raw.icp0.io"
Error details:
An error occurred while validating the derivationOrigin "https://6japz-gyaaa-aaaag-accza-cai.raw.icp0.io": Failed to fetch

How can I connect my nns account to login to the Candid UI?
Are there settings I need to set when deploying the canister?

Thanks!

[frederikrothenberger]

Hi @nolma

You are hitting a special case here which is related to principal derivation on Internet Identity. Normally Internet Identity hands out different principals for each application. There is a feature however, to have two applications with different URLs use the same principal. It is called alternative origins and is documented here.

Apparently, candid UI now supports that feature (very useful for debugging), which means it is able to use the same principal as you would have on your own front-end given you grant it the permission to do so. The error you see here, is because you are currently not granting it the permission.

To grant it the permission, simply host a file in your canister using the path /.well-known/ii-alternative-origins and add the following content:

{
  "alternativeOrigins": ["https://a4gq6-oaaaa-aaaab-qaa4q-cai.raw.icp0.io"]
}

Be aware of the consequences though: This allows the Candid UI canister a4gq6-oaaaa-aaaab-qaa4q-cai to use the same principals as you get on your front-end (https://6japz-gyaaa-aaaag-accza-cai.raw.icp0.io). It can therefore impersonate your front-end, which would be really bad if it were to turn malicious (I don’t know who controls a4gq6-oaaaa-aaaab-qaa4q-cai). Remove the entry from the /.well-known/ii-alternative-origins file before associating anything of value with the user principals from your front-end.

You should also be able to deploy your own candid UI to mainnet if you don’t trust a4gq6-oaaaa-aaaab-qaa4q-cai. @Severin: What would be the easiest way to do so?

[Severin]

The easiest way to deploy your own Candid UI is to clone this folder, delete canister_ids.json (so dfx doesn’t try to deploy to the ‘official’ Candid UI, and then deploy the project for yourself

[Samer]

@nolma

If your canister is written in Motoko, here’s what you need to add for it to work with Candid UI login.

Web3NL/candid/blob/test-authenticated-calls/tools/ui/target_test_canister/main.mo

If you are not using the http_request function for fast certified queries, you can add the upgrade = ?true; field in the response and serve the alternativeOrigin file from http_request_update, see example

[zensh]

@Severin
I recently encountered an “Invalid Derivation Origin” issue.

A few days ago, I faced this problem when logging into oc.app, but today it worked fine.
However, I’m now experiencing the same issue with dmsg.net and can’t log in at all, despite no new version being released recently.

[Severin]

I don’t know this enough to help. @lmuntaner maybe?

[lmuntaner]

Weird, it’s working for me…

From where do you login?

Did someone upgrade panda.fans maybe? The alternative origins file is properly set: https://panda.fans/.well-known/ii-alternative-origins

[zensh]

I can sign in normally now. panda.fans hasn’t been updated, so I suspect it was a node or boundary gateway upgrade and restart that I happened to encounter.

[lmuntaner]

That could be. Good to know it’s all working normally again.