IPC custom protocol failed, Tauri will now use the postMessa

Error message

IPC custom protocol failed, Tauri will now use the postMessage interface instead

What it means

On non-Android platforms sendIpcMessage first POSTs to Tauri's custom IPC protocol (ipc://localhost, exposed as http://ipc.localhost) via fetch, carrying the serialized payload and callback ids in headers. If that fetch rejects — typically because the page CSP blocks the request or the webview refuses the custom protocol — Tauri logs this warning, sets customProtocolIpcFailed = true and transparently re-sends the message over the postMessage transport. IPC keeps working; the cost is the slower transport, which matters for large payloads.

Source

Thrown at crates/tauri/scripts/ipc-protocol.js:60

        .then((response) => {
          const callbackId =
            response.headers.get('Tauri-Response') === 'ok' ? callback : error
          // we need to split here because on Android the content-type gets duplicated
          switch ((response.headers.get('content-type') || '').split(',')[0]) {
            case 'application/json':
              return response.json().then((r) => [callbackId, r])
            case 'text/plain':
              return response.text().then((r) => [callbackId, r])
            default:
              return response.arrayBuffer().then((r) => [callbackId, r])
          }
        })
        .then(
          ([callbackId, data]) => {
            window.__TAURI_INTERNALS__.runCallback(callbackId, data)
          },
          (e) => {
            console.warn(
              'IPC custom protocol failed, Tauri will now use the postMessage interface instead',
              e
            )
            // failed to use the custom protocol IPC (either the webview blocked a custom protocol or it was a CSP error)
            // so we need to fallback to the postMessage interface
            customProtocolIpcFailed = true
            sendIpcMessage(message)
          }
        )
    } else {
      // otherwise use the postMessage interface
      const { data } = processIpcMessage({
        cmd,
        callback,
        error,
        options: {
          ...options,
          customProtocolIpcBlocked: customProtocolIpcFailed

View on GitHub (pinned to 52e4b6e71d)

Solutions

Add ipc: http://ipc.localhost to connect-src of security.csp in tauri.conf.json.
If dangerousDisableAssetCspModification is true, add those source expressions yourself to the served document's CSP.
Verify in devtools that the fetch to ipc://localhost (http://ipc.localhost) no longer fails; the warning should disappear on the next run.
If the environment genuinely cannot use the custom protocol, accept the automatic postMessage fallback — but keep invoke payloads small or move bulk transfers to the asset protocol to avoid its overhead.

Example fix

// before: tauri.conf.json — custom CSP drops the IPC source expressions
{
  "security": {
    "csp": "default-src 'self'; connect-src 'self'"
  }
}

// after: connect-src allows the custom IPC protocol
{
  "security": {
    "csp": "default-src 'self'; connect-src 'self' ipc: http://ipc.localhost"
  }
}

Defensive patterns

Strategy: fallback

Validate before calling

// Optional pre-flight: probe whether the custom IPC protocol is
// reachable before relying on it for large payloads
fetch(window.__TAURI_INTERNALS__.convertFileSrc('probe', 'ipc'), { method: 'HEAD' })
  .then(() => console.info('custom IPC protocol available'))
  .catch(() => console.warn('IPC will use the postMessage fallback'))

Prevention

Always include ipc: http://ipc.localhost in the connect-src of security.csp in tauri.conf.json.
If setting dangerousDisableAssetCspModification: true, add the IPC source expressions to the document CSP yourself.
Check devtools network/console after changing CSP to confirm the ipc://localhost fetch succeeds.
Design IPC payloads small; if forced onto the postMessage fallback, move bulk data to the asset protocol or custom protocol endpoints.

When it happens

Trigger: A CSP whose connect-src lacks ipc: http://ipc.localhost (custom security.csp, or dangerousDisableAssetCspModification: true without adding them manually); remote or iframe content whose origin cannot fetch the custom protocol; WebView configurations that block custom-scheme fetches. The warn fires on the first failed fetch, after which every message uses postMessage.

Common situations: Setting a hand-written csp string in tauri.conf.json and forgetting connect-src ipc entries; disabling Tauri's automatic CSP injection; loading remote URLs in the webview; the warning appearing only on some platforms or only inside iframes.

Related errors

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/80f870aed2a462e2. Report an issue: GitHub.