DioxusLabs/dioxus · error

Bad Request: Missing key

Error message

Bad Request: Missing key

What it means

The desktop IPC server received a path /<webview_id>/ with no second segment, so no authentication key was supplied. The key component is mandatory for every request and its absence produces this 400 response.

Source

Thrown at packages/desktop/src/edits.rs:310

        #[allow(clippy::result_large_err)]
        let on_request = |req: &Request, res| {
            // Try to parse the webview id and key from the path
            let path = req.uri().path();

            // The path should have two parts `/webview_id/key`
            let mut segments = path.trim_matches('/').split('/');
            let webview_id = segments
                .next()
                .and_then(|s| s.parse::<u32>().ok())
                .ok_or_else(|| {
                    Response::builder()
                        .status(400)
                        .body(Some("Bad Request: Invalid webview ID".to_string()))
                        .unwrap()
                })?;
            let key = segments.next().ok_or_else(|| {
                Response::builder()
                    .status(400)
                    .body(Some("Bad Request: Missing key".to_string()))
                    .unwrap()
            })?;

            // Make sure the key matches the expected key.
            // VERY IMPORTANT: We cannot use normal string comparison here because it reveals information
            // about the key based on timing information. Instead we use a constant time comparison method.
            let key_matches: bool =
                subtle::ConstantTimeEq::ct_eq(hex_encoded_client_key.as_ref(), key.as_bytes())
                    .into();
            if !key_matches {
                return Err(Response::builder()
                    .status(403)
                    .body(Some("Forbidden: Invalid key".to_string()))
                    .unwrap());
            }

            location = Some(WebviewWebsocketLocation {

View on GitHub (pinned to 24f6a829df)

Solutions

1. Include the required key field in the request payload sent to the desktop edit handler.

When it happens

Trigger: Thrown at packages/desktop/src/edits.rs:310 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of DioxusLabs/dioxus@24f6a829df (2026-08-23). Data as JSON: /api/errors/2a7726e0855951ad. Report an issue: GitHub.