{"record":{"id":"c751ff617aeac916","repo":"DioxusLabs/dioxus","slug":"forbidden-invalid-key","errorCode":null,"errorMessage":"Forbidden: Invalid key","messagePattern":"Forbidden: Invalid key","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"packages/desktop/src/edits.rs","lineNumber":323,"sourceCode":"                        .body(Some(\"Bad Request: Invalid webview ID\".to_string()))\n                        .unwrap()\n                })?;\n            let key = segments.next().ok_or_else(|| {\n                Response::builder()\n                    .status(400)\n                    .body(Some(\"Bad Request: Missing key\".to_string()))\n                    .unwrap()\n            })?;\n\n            // Make sure the key matches the expected key.\n            // VERY IMPORTANT: We cannot use normal string comparison here because it reveals information\n            // about the key based on timing information. Instead we use a constant time comparison method.\n            let key_matches: bool =\n                subtle::ConstantTimeEq::ct_eq(hex_encoded_client_key.as_ref(), key.as_bytes())\n                    .into();\n            if !key_matches {\n                return Err(Response::builder()\n                    .status(403)\n                    .body(Some(\"Forbidden: Invalid key\".to_string()))\n                    .unwrap());\n            }\n\n            location = Some(WebviewWebsocketLocation {\n                webview_id,\n                server: server_location,\n            });\n\n            Ok(res)\n        };\n\n        // Accept the websocket connection while reading the path and setting the location\n        let mut websocket = match tungstenite::accept_hdr(stream, on_request) {\n            Ok(ws) => ws,\n            Err(e) => {\n                tracing::error!(\"Error accepting websocket connection: {}\", e);\n                return;","sourceCodeStart":305,"sourceCodeEnd":341,"githubUrl":"https://github.com/DioxusLabs/dioxus/blob/24f6a829df0dfa203961a98ea4cae21c2ff27e28/packages/desktop/src/edits.rs#L305-L341","documentation":"The request's key failed the constant-time comparison against the server's expected key in the desktop IPC handler. This 403 guards against both wrong keys and timing side channels; any mismatch (or missing trailing data) is rejected.","triggerScenarios":"Thrown at packages/desktop/src/edits.rs:323 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The supplied key does not match the session key. Pass the key that was generated when the devserver or webview session started."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"24f6a829df0dfa203961a98ea4cae21c2ff27e28","analyzedAt":"2026-08-23T07:10:14.078Z","contentChangedAt":"2026-08-23T07:10:14.078Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}