# V1 http-request certification issue

**URL:** <https://forum.dfinity.org/t/v1-http-request-certification-issue/31189>\
**Category:** CDK\
**Created:** [May 26, 2024, 6:43pm UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189 "2024-05-26T18:43:57Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![cken](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/cken/32/17166_2.png) [@cken](https://forum.dfinity.org/u/cken)\
**Post date:** [May 26, 2024, 6:43pm UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/1 "2024-05-26T18:43:57Z")

</div>

I’m trying to generate a properly encoded response for the http-request system API from scratch. However, I’m running into the `Body does not pass verification` error.

I can query the endpoint using the Candid UI which returns:

```auto
(record 
  {
    body=vec {31; 139; 8; 0; 33; 117; 83; 102; 2; 255; 179; 201; 40; 201; 205; 177; 227; 82; 0; 2; 155; 164; 252; 148; 74; 8; 19; 4; 60; 82; 115; 114; 242; 117; 20; 194; 243; 139; 114; 82; 20; 33; 10; 244; 33; 42; 108; 244; 33; 154; 0; 164; 199; 192; 64; 60; 0; 0; 0};
    headers=vec {
      record {"Content-Type"; "text/html; charset=utf-8"};
      record {"Content-Encoding"; "gzip"}; record {"Content-Length"; "59"};
      record {"IC-Certificate";
        "certificate=:2dn3omR0cmVlgwGDAYMBggRYICZ9EIuCUUnIiSJ/IgyiAROM5iHDHHw88XQRfnAVEQu3gwJIY2FuaXN0ZXKDAYMBggRYIHIcQPRl0NXl9DqdgXakKGSri8/asl+A6ju2fHB5bkEGgwJKgAAAAAAQAAEBAYMBgwGDAk5jZXJ0aWZpZWRfZGF0YYIDWCA9Gi23gwjYQTYNJ/sSTLj5tFh+se6ZWX2vuz0Qm/QRO4IEWCC9sZJnLAN1uq9V0Apa9RPw26aliigoYp4IgEBw5SbHvYIEWCDx0ExzGXLJMFhEQrw5f9bOvhpvqjhBnwmtwiQpj5r4hYIEWCBw5Ein3AOf0rJYMpDqM7bU1uZVylp412HlFZg1DiB804IEWCC1mnRylI+ZnmLvXtI5yKLhOArpOzrae99uuBVYtmQhiYMBggRYIPawll8UFvmzjaxG4lTkwZUn3+o5qRTmb8lNuR3+fAlLgwJEdGltZYIDSa600PPW5MbpF2lzaWduYXR1cmVYMK1e/XVNGP5aOZ8Qqhgwdxdh6lvu4ZC/QeOTELTQIoOTUXHTs8hrPZ5Tsf3fCdvl3w==:,
         tree=:ggGDAktodHRwX2Fzc2V0c4IBgwJLL2luZGV4Lmh0bWyCA1ggwngs/wYRCS72n7b+wWbqchIVyOvXvEosQ2eHZ/38q1A=:"}};
      status_code=200
    }
)

```

I’m testing this locally using dfx, but if I calculate the root hash for the `tree` in `IC-Certificate` it matches the `certified_data` hash in `certificate['tree']`. The sha256 hash of the body also matches the `tree['/index.html']` hash. The public key, signature, and message when passed to the bls implementation used by `agent-js` also passes, and the body properly gzip decompresses to the expected HTML.

Is the “Body does not pass verification” error produced by some portion of the HTTP gateway that’s not open sourced? I’m having trouble figuring what else might be wrong with this response. If I remove the `IC-Certificate` header, it works as expected since it’s not being certified in that case.

---

<div class="post-metadata">

**Author:** ![Vivienne](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/vivienne/32/29170_2.png) [@Vivienne](https://forum.dfinity.org/u/Vivienne)\
**Post date:** [May 27, 2024, 9:30am UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/2 "2024-05-27T09:30:04Z")

</div>

[Here](https://github.com/dfinity/sdk/blob/f3c5b68d82fe12230fc5210f3ee5a1a8b88dc2cc/src/canisters/frontend/ic-certified-assets/src/tests.rs#L85) is how we do certification tests in the asset canister. Maybe you can use it for inspiration?

From the [v1 spec](https://internetcomputer.org/docs/current/references/http-gateway-protocol-spec#legacy-response-verification):

> - The path `["http_assets", <url>]` exists in the `tree` and is a leaf with a value, where `<url>` is the utf8-encoded URL from the `HttpRequest`.

But you say

> [@cken](#):
>
> The sha256 hash of the body also matches the `tree['/index.html']` hash.

Should it be `tree['http_assets', '/index.html']` instead?

> [@cken](#):
>
> Is the “Body does not pass verification” error produced by some portion of the HTTP gateway that’s not open sourced?

@NathanosDev, please correct me if I’m wrong, but the boundary nodes use the `ic-response-verification` crate that you can also see in use in the tests I linked above and nothing else (at least for the `Body does not pass verification` part).

---

<div class="post-metadata">

**Author:** ![NathanosDev](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nathanosdev/32/7204_2.png) [@NathanosDev](https://forum.dfinity.org/u/NathanosDev)\
**Post date:** [May 27, 2024, 10:00am UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/3 "2024-05-27T10:00:58Z")

</div>

> [@Vivienne](#):
>
> [Here](https://github.com/dfinity/sdk/blob/f3c5b68d82fe12230fc5210f3ee5a1a8b88dc2cc/src/canisters/frontend/ic-certified-assets/src/tests.rs#L85) is how we do certification tests in the asset canister. Maybe you can use it for inspiration?

I second this. Making some automation tests will make your life much, much easier when debugging this stuff. Using the `ic-response-verification` crate directly allows you to extract the exact error that is being emitted and that can help track down the source of any issues.

> [@Vivienne](#):
>
> Should it be `tree['http_assets', '/index.html']` instead?

This seems to be the case in the tree provided by the `IC-Certificate` header in his example.

> [@Vivienne](#):
>
> @NathanosDev, please correct me if I’m wrong, but the boundary nodes use the `ic-response-verification` crate that you can also see in use in the tests I linked above and nothing else (at least for the `Body does not pass verification` part).

Yep, I’d really recommend this approach.

> [@cken](#):
>
> Is the “Body does not pass verification” error produced by some portion of the HTTP gateway that’s not open sourced? I’m having trouble figuring what else might be wrong with this response. If I remove the `IC-Certificate` header, it works as expected since it’s not being certified in that case.

There’s no part of the HTTP Gateway that’s not open sourced. Everything related to the verification of responses can be found [here](https://github.com/dfinity/response-verification/tree/main/packages/ic-response-verification).

> [@cken](#):
>
> I’m testing this locally using dfx, but if I calculate the root hash for the `tree` in `IC-Certificate` it matches the `certified_data` hash in `certificate['tree']`. The sha256 hash of the body also matches the `tree['/index.html']` hash. The public key, signature, and message when passed to the bls implementation used by `agent-js` also passes, and the body properly gzip decompresses to the expected HTML.

Does the leaf at `['http_asset', '/index.html']` match sha256 of the _encoded_ or _decoded_ body? For v1, it should be the hash of the _decoded_ body.

---

<div class="post-metadata">

**Author:** ![cken](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/cken/32/17166_2.png) [@cken](https://forum.dfinity.org/u/cken)\
**Post date:** [May 27, 2024, 6:05pm UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/4 "2024-05-27T18:05:55Z")

</div>

Thanks for the links. That’s the test I have been referencing.

> [@Vivienne](#):
>
> Should it be `tree['http_assets', '/index.html']` instead?

You’re right about this. I was kind of writing pseudocode there.

---

<div class="post-metadata">

**Author:** ![cken](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/cken/32/17166_2.png) [@cken](https://forum.dfinity.org/u/cken)\
**Post date:** [May 27, 2024, 6:13pm UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/5 "2024-05-27T18:13:53Z")

</div>

> [@NathanosDev](#):
>
> Does the leaf at `['http_asset', '/index.html']` match sha256 of the _encoded_ or _decoded_ body? For v1, it should be the hash of the _decoded_ body.

It matches based on the decoded body. Good point though, I did run into that issue previously.

Any idea where that exact error message originates from? I was trying to trace if it might be caused by something other than the actual body certification/verification.

Good to know I’m looking at the right code at least though. I’ll keep digging.

---

<div class="post-metadata">

**Author:** ![NathanosDev](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/nathanosdev/32/7204_2.png) [@NathanosDev](https://forum.dfinity.org/u/NathanosDev)\
**Post date:** [May 28, 2024, 7:53am UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/6 "2024-05-28T07:53:43Z")

</div>

> [@cken](#):
>
> Any idea where that exact error message originates from?

The error originates here: [ic/rs/boundary\_node/icx\_proxy/src/validate.rs at master · dfinity/ic · GitHub](https://github.com/dfinity/ic/blob/master/rs/boundary_node/icx_proxy/src/validate.rs#L54-L63)

> [@cken](#):
>
> I was trying to trace if it might be caused by something other than the actual body certification/verification.

It’s definitely a certification issue, please write a test and use `ic-response-verification` (Rust) or `@dfinity/response-verification` (JavaScript) directly so you can observe the original error.

---

<div class="post-metadata">

**Author:** ![cken](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/cken/32/17166_2.png) [@cken](https://forum.dfinity.org/u/cken)\
**Post date:** [May 28, 2024, 2:58pm UTC](https://forum.dfinity.org/t/v1-http-request-certification-issue/31189/7 "2024-05-28T14:58:18Z")

</div>

Aha! I could’ve sworn I searched the organization for it on Github and it wasn’t finding it… Thanks for the links though, that will be helpful!