{"record":{"id":"09d4d7ff44bfee6b","repo":"gchq/CyberChef","slug":"invalid-base64-payload-09d4d7","errorCode":null,"errorMessage":"Invalid Base64 payload","messagePattern":"Invalid Base64 payload","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FlaskSessionVerify.mjs","lineNumber":104,"sourceCode":"        const base64 = payloadB64.replace(/-/g, \"+\").replace(/_/g, \"/\");\n        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\");\n\n        const time = parts[1];\n\n        const timeB64 = time.replace(/-/g, \"+\").replace(/_/g, \"/\");\n        const binary = fromBase64(timeB64);\n        const bytes = new Uint8Array(4);\n        for (let i = 0; i < 4; i++) {\n            bytes[i] = binary.charCodeAt(i);\n        }\n        const view = new DataView(bytes.buffer);\n        const timestamp = view.getInt32(0, false);\n\n        let payloadJson;\n        try {\n            payloadJson = fromBase64(padded);\n        } catch (e) {\n            throw new OperationError(\"Invalid Base64 payload\");\n        }\n\n        const signB64 = toBase64(sign.finalize());\n        const sign64 = signB64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n\n        if (sign64 !== parts[2]) {\n            throw new OperationError(\"Invalid signature!\");\n        }\n\n        try {\n            const decoded = JSON.parse(payloadJson);\n            if (!args[3]) {\n                return {\n                    valid: true,\n                    payload: decoded,\n                };\n            } else {\n                return {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FlaskSessionVerify.mjs#L86-L122","documentation":"Thrown by the Flask Session Verify operation when the payload segment (parts[0]) of the cookie cannot be decoded as Base64. The code first converts URL-safe characters (-/_ ) to standard (+//) and pads with '=', then calls fromBase64(padded); any failure is caught and rethrown as this OperationError. It signals that the first dotted segment is not a valid Base64-encoded payload, so the cookie structure is wrong before signature checking even begins.","triggerScenarios":"Running Flask Session Verify on a string whose first dot-delimited segment is not Base64 (e.g. an edited/truncated payload, a non-Flask cookie, or a cookie where the payload contains characters outside the URL-safe Base64 alphabet after conversion). Also triggered if parts.length is 3 by accident but segment 0 is arbitrary text.","commonSituations":"Pasting a JWT or other signed token that is not an itsdangerous Flask session cookie; copying only part of the cookie; URL-decoding artifacts left in the payload; mismatched delimiters causing the split to misalign segments.","solutions":["Confirm the input is a real Flask session cookie of the form payload.timestamp.signature produced by itsdangerous/Flask.","Verify segment 0 (before the first dot) only contains URL-safe Base64 chars [A-Za-z0-9_-] and is complete.","Ensure the input is pasted verbatim without trimming internal characters; only leading/trailing whitespace is stripped by the operation.","If testing manually, generate a known-good cookie via Flask and feed that in to isolate the problem."],"exampleFix":"// before: feeding a non-Flask token\nverify.run('eyJhbGci.foo.bar', args) // wrong shape\n// after: feed a genuine Flask session cookie\nverify.run('eyJ1c2VyIjoiYWxpY2UifQ.ZmFrZS5zaWc', args)","handlingStrategy":"validation","validationCode":"// Validate a Flask session cookie payload segment is URL-safe Base64 before calling run()\nfunction isValidPayloadB64(seg) {\n  const std = seg.replace(/-/g, '+').replace(/_/g, '/');\n  return /^[A-Za-z0-9+/]*={0,2}$/.test(std.padEnd(Math.ceil(std.length / 4) * 4, '='));\n}\nconst parts = cookie.trim().split('.');\nif (parts.length !== 3 || !isValidPayloadB64(parts[0])) {\n  // do not call run(); handle gracefully\n}","typeGuard":"// Narrow a string to a plausibly-shaped Flask session cookie\nfunction isFlaskCookieShape(s) {\n  const parts = String(s).trim().split('.');\n  return parts.length === 3 && parts.every(p => /^[A-Za-z0-9_-]+$/.test(p));\n}","tryCatchPattern":"try {\n  const result = flaskVerify.run(cookie, args);\n} catch (e) {\n  if (e.type === 'OperationError' && /Invalid Base64 payload/.test(e.message)) {\n    // cookie payload is malformed; surface a friendly message\n  } else throw e;\n}","preventionTips":["Always source the cookie directly from the browser's Cookie header or document.cookie.","Validate the three-segment structure and Base64 alphabet before invoking.","Avoid hand-editing cookie segments before verification."],"tags":["flask","base64","session-cookie","crypto","input-validation"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}