DioxusLabs/dioxus · error

Forbidden: Invalid key

Error message

Forbidden: Invalid key

What it means

The request's key failed the constant-time comparison against the server's expected key in the desktop IPC handler. This 403 guards against both wrong keys and timing side channels; any mismatch (or missing trailing data) is rejected.

Source

Thrown at packages/desktop/src/edits.rs:323

                        .body(Some("Bad Request: Invalid webview ID".to_string()))
                        .unwrap()
                })?;
            let key = segments.next().ok_or_else(|| {
                Response::builder()
                    .status(400)
                    .body(Some("Bad Request: Missing key".to_string()))
                    .unwrap()
            })?;

            // Make sure the key matches the expected key.
            // VERY IMPORTANT: We cannot use normal string comparison here because it reveals information
            // about the key based on timing information. Instead we use a constant time comparison method.
            let key_matches: bool =
                subtle::ConstantTimeEq::ct_eq(hex_encoded_client_key.as_ref(), key.as_bytes())
                    .into();
            if !key_matches {
                return Err(Response::builder()
                    .status(403)
                    .body(Some("Forbidden: Invalid key".to_string()))
                    .unwrap());
            }

            location = Some(WebviewWebsocketLocation {
                webview_id,
                server: server_location,
            });

            Ok(res)
        };

        // Accept the websocket connection while reading the path and setting the location
        let mut websocket = match tungstenite::accept_hdr(stream, on_request) {
            Ok(ws) => ws,
            Err(e) => {
                tracing::error!("Error accepting websocket connection: {}", e);
                return;

View on GitHub (pinned to 24f6a829df)

Solutions

1. The supplied key does not match the session key. Pass the key that was generated when the devserver or webview session started.

When it happens

Trigger: Thrown at packages/desktop/src/edits.rs:323 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of DioxusLabs/dioxus@24f6a829df (2026-08-23). Data as JSON: /api/errors/c751ff617aeac916. Report an issue: GitHub.