JeffreySu/WeiXinMPSDK · error · WxOpenException

SessionKey无效

Error message

SessionKey无效

What it means

Thrown by DecodeEncryptedDataBySessionId when the session exists but its SessionKey is null or empty, making AES decryption of the encrypted payload impossible. Indicates the stored session lacks the session_key issued by WeChat's jscode2session.

Solutions

1. Ensure jscode2session succeeded and session_key was persisted in the bag before accepting the sessionId
2. Re-authenticate (wx.login + jscode2session) to obtain a fresh SessionKey
3. Add a server-side check for SessionKey presence before returning sessionId to the client
4. Catch WxOpenException and treat as a forced re-login

Example fix

// before
var json = EncryptHelper.DecodeEncryptedDataBySessionId(sessionId, encryptedData, iv);
// after
var bag = SessionContainer.GetSession(sessionId);
if (bag == null || string.IsNullOrEmpty(bag.SessionKey)) {
    return ForceRelogin();
}
var json = EncryptHelper.DecodeEncryptedDataBySessionId(sessionId, encryptedData, iv);

var bag = SessionContainer.GetSession(sessionId);
if (bag == null || string.IsNullOrEmpty(bag.SessionKey)) {
    return ForceRelogin();
}

bool SessionKeyReady(string sessionId) => SessionContainer.GetSession(sessionId)?.SessionKey is { Length: > 0 };

try {
    var json = EncryptHelper.DecodeEncryptedDataBySessionId(sessionId, encryptedData, iv);
} catch (WxOpenException ex) when (ex.Message.Contains("SessionKey无效")) {
    return Unauthorized("session key missing, re-authenticate");
}

When it happens

Trigger: Calling DecodeEncryptedDataBySessionId for a session whose SessionKey was never populated (failed js2session, manually created session bag) or was cleared.

Common situations: Storing sessions from a jscode2session call that returned an error code; custom session storage that omits SessionKey; partial serialization of the session bag in cache.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• SessionKey无效（02）
• SessionId无效
• SessionId无效（01）
• 凭据提供器返回了空 AppSecret。
• MsgType： 在RequestMessageFactory中没有对应的处理程序！

AI-assisted analysis of JeffreySu/WeiXinMPSDK@be573f6f94 (2026-09-12). Data as JSON: /api/errors/39c64ce399cdfba6. Report an issue: GitHub.

Appendix: source

Thrown at src/Senparc.Weixin.WxOpen/src/Senparc.Weixin.WxOpen/Senparc.Weixin.WxOpen/Helpers/EncryptHelper.cs:256

        /// <summary>
        /// 解密消息（通过SessionId获取）
        /// </summary>
        /// <param name="sessionId"></param>
        /// <param name="encryptedData"></param>
        /// <param name="iv"></param>
        /// <exception cref="WxOpenException">当SessionId或SessionKey无效时抛出异常</exception>
        /// <returns></returns>
        public static string DecodeEncryptedDataBySessionId(string sessionId, string encryptedData, string iv)
        {
            var sessionBag = SessionContainer.GetSession(sessionId);
            if (sessionBag == null)
            {
                throw new WxOpenException("SessionId无效");
            }

            if (string.IsNullOrEmpty(sessionBag.SessionKey))
            {
                throw new WxOpenException("SessionKey无效");
            }

            var resultStr = DecodeEncryptedData(sessionBag.SessionKey, encryptedData, iv);
            return resultStr;
        }


        /// <summary>
        /// 检查解密消息水印
        /// </summary>
        /// <param name="entity"></param>
        /// <param name="appId"></param>
        /// <returns>entity为null时也会返回false</returns>
        public static bool CheckWatermark(this DecodeEntityBase entity, string appId)
        {
            if (entity == null)
            {
                return false;

View on GitHub (pinned to be573f6f94)