Staged rollout of Boundary Node security upgrades that might impact dApps - action may be required

Developers
21

It is working. The release with issues in it was rolled back

22

the request

icp-api.io
ic0.app

will there be any difference

I request ic0.app when staking neurons
Initiate manage_neuron’s

claim_or_refresh_arg = ManageNeuron {
        id: None,
        command:Some(Command::ClaimOrRefresh(ClaimOrRefresh{
            by:Some(By::MemoAndController(ClaimOrRefreshNeuronFromAccount{
                controller: Some(public_sender),
                memo: _memo
            }))
        })),
        neuron_id_or_subaccount: None
    }

return error message

No neuron ID specified in the management request.
23

Hi @ic_axb

I replied to this in your other thread: Are there any differences between https://ic0.app and https://icp-api.io - #2 by rbirkner

24

Hello folks! Reminder that tomorrow (July 5th) we will be doing our 24h production test at 5pm UTC.
Please use this thread to report errors if you encounter any.

2 Likes
25

Hi folks - this is an update to let you know that the boundary nodes have been updated for the 24h period.

If you run into any issues please let us know in this thread.

1 Like
26

Not sure if it is related. Sometimes I get this, sometimes I don’t. I think it’s related to Internet Identity. I repeatedly logout and login and it fixes or breaks.

image
image1920×1892 370 KB

27

Exactly, it is related to this topic. The projects will solve it these days! :wink:

28

Hello there - some community members noticed issues affecting their production apps. We’re cutting the test short and rolling back the boundary nodes to the previous version.
I’ll update this thread when the rollback is done.

Based on the results of this experiment, we might adjust the rollout plan and will keep you updated in this thread.

29

I had problems with some origyn features ( ORIGYN Governance Dashboard) Also, I already spoke with @skilesare , I thank him for his time! they will fix it soon!

–
ADD: Now it works!

30

Rollback is complete.

For those who want to test - the host at [2604:6800:258:1:5000:98ff:fe7d:347b], [162.247.129.233] has the future configuration and is still available for you to test.

31

Hello folks - please note that we’ve adjusted the timeline in response to the issues from the production test on July 5th.

Essentially we’re pushing full production rollout by a week - we’ll use July 12th to run another 24h test and give folks a chance to validate their fixes from this week.

32

Hello everyone - the rollout for the 24h test is starting now - please notify us in this thread if you run into any issues.

2 Likes
33

Access to fetch at ‘https://boundary.ic0.app/api/v2/canister/ **** /query’ from origin ‘https://governance.origyn.network’ has been blocked by CORS policy: Response to preflight request doesn’t pass access control check: Redirect is not allowed for a preflight request.

34

This is happening on the Origyn Dashboard. It is a bit of a lift to re-bootstrap our ci/cd at the moment and (teaser) we are hoping to have a brand new dapp running on the IC out as soon as Monday…so we’re just going to ride this test out and push to have the new dapp out before this goes live.

1 Like
35

@skilesare @FranHefner I’m going to start rolling back shortly.

Note that eventually /api requests to any domain that is not strictly to the base domains will be rejected.

1 Like
36

Hi folks - we deployed a canary of this today and expect to do a full production rollout tomorrow.
Please reply here if you run into any problems.

37

Hello everyone and thanks for putting up with all the changes.
We’re at the last phase (which was supposed to be for july 26th) were we are planning to disable the redirects.

We’ve delayed the change a little bit because there are some 80k requests per hour going to boundary.ic0.app that will break when we disable redirects. They seem to be coming mostly from the same machines which look like they’re pulling transaction information.

We’re trying to identify the source of the requests to give them a warning in case they’ve missed the thread.

38

We found that this was messing with our Rosetta API(thanks @bitbruce ). We’ve notified the two exchanges that run their own rosetta nodes pointing to the OGY ledger, but haven’t heard much back from them. I’ll follow up…perhaps there are others running rosetta nodes against ICP?

39

Normally the rosetta endpoints should not have been affected by this change.
Do you know exactly what is broken?

40

image
image720×122 43.1 KB

We changed our config to use icp-api.io and the errors went away.

2 Likes