{"record":{"id":"5077191741ad16c2","repo":"gchq/CyberChef","slug":"secret-key-required-507719","errorCode":null,"errorMessage":"Secret key required","messagePattern":"Secret key required","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FlaskSessionVerify.mjs","lineNumber":61,"sourceCode":"                value: [\"sha1\", \"sha256\"],\n            },\n            {\n                name: \"View TimeStamp\",\n                type: \"boolean\",\n                value: true\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n\n        if (!args[0].string) {\n            throw new OperationError(\"Secret key required\");\n        }\n\n        const key = Utils.convertToByteString(args[0].string, args[0].option);\n        const salt = Utils.convertToByteString(args[1].string || \"cookie-session\", args[1].option);\n        const algorithm = args[2] || \"sha1\";\n\n        input = input.trim();\n\n        const parts = input.split(\".\");\n\n        if (parts.length !== 3) {\n            throw new OperationError(\"Invalid Flask token format. Expected payload.timestamp.signature\");\n        }\n\n        const data = Utils.convertToByteString(parts[0] + \".\" + parts[1], \"utf8\");\n\n\n        const derivedKey = CryptoApi.getHmac(key, CryptoApi.getHasher(algorithm));","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FlaskSessionVerify.mjs#L43-L79","documentation":"Thrown by the Flask Session Verify operation when the secret key argument (args[0].string) is empty/falsy. Verifying a Flask session cookie's HMAC signature requires the same secret key used to sign it. Without the key, the HMAC cannot be recomputed for comparison.","triggerScenarios":"run(input, args) at line 60 where !args[0].string is true. The 'Key' toggleString argument has an empty string value.","commonSituations":"User leaves the Key field blank when attempting to verify a session cookie. The key encoding toggle may be set but the string value is empty.","solutions":["Enter the Flask application's SECRET_KEY that was used to sign the cookie.","Select the correct key encoding (Hex, UTF8, Base64, etc.) matching how the key is stored.","Retrieve the SECRET_KEY from the Flask app configuration."],"exampleFix":"// before: args[0] = {string: '', option: 'UTF8'} -> error\n\n// after: args[0] = {string: 'my-secret-key-123', option: 'UTF8'}","handlingStrategy":"validation","validationCode":"// Ensure key is non-empty before calling FlaskSessionVerify\nif (!args[0] || !args[0].string || !args[0].string.trim()) {\n  throw new Error('A non-empty secret key is required');\n}","typeGuard":"function hasSecretKey(keyArg) {\n  return keyArg && typeof keyArg.string === 'string' && keyArg.string.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Provide the exact SECRET_KEY used to sign the cookie.","Match the key encoding to how it is stored.","Verify the key is non-empty before running."],"tags":["crypto","flask","session","hmac","key-required"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}