{"record":{"id":"59af364467f510df","repo":"apache/seatunnel","slug":"invalid-secret-key-not-base64-encoded","errorCode":null,"errorMessage":"Invalid secret_key: not Base64 encoded","messagePattern":"Invalid secret_key: not Base64 encoded","errorType":"validation","errorClass":"OptionValidationException","httpStatus":null,"severity":"error","filePath":"seatunnel-connectors-v2/connector-edge-socket/src/main/java/org/apache/seatunnel/connectors/seatunnel/edgesocket/source/EdgeSocketSourceFactory.java","lineNumber":158,"sourceCode":"        @Override\n        public boolean evaluate(ReadonlyConfig config, String secretKey) {\n            if (secretKey == null) {\n                return true;\n            }\n            EdgeSocketPacketMode packetMode;\n            try {\n                packetMode = config.get(EdgeSocketSourceOptions.PACKET_MODE);\n            } catch (IllegalArgumentException exception) {\n                return true;\n            }\n            if (packetMode != EdgeSocketPacketMode.PACKET) {\n                return true;\n            }\n            byte[] secretKeyBytes;\n            try {\n                secretKeyBytes = Base64.getDecoder().decode(secretKey);\n            } catch (IllegalArgumentException exception) {\n                throw new OptionValidationException(\"Invalid secret_key: not Base64 encoded\");\n            }\n            if (secretKeyBytes.length != 32) {\n                throw new OptionValidationException(\n                        \"Invalid secret_key: AES-256 requires exactly 32 bytes, \"\n                                + \"but got %d bytes after Base64 decoding\",\n                        secretKeyBytes.length);\n            }\n            return true;\n        }\n    }\n}\n","sourceCodeStart":140,"sourceCodeEnd":170,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-edge-socket/src/main/java/org/apache/seatunnel/connectors/seatunnel/edgesocket/source/EdgeSocketSourceFactory.java#L140-L170","documentation":"The secret_key option must be a Base64-encoded 32-byte AES-256 key. Validation first Base64-decodes the value; if decoding throws IllegalArgumentException, OptionValidationException 'Invalid secret_key: not Base64 encoded' is thrown. This catches keys containing characters outside the Base64 alphabet or invalid padding.","triggerScenarios":"evaluate() is called with a secret_key containing illegal characters (spaces, '!', unicode), wrong padding (missing '=' or stray characters), a raw hex or plaintext key, or an empty-but-present string when a key is required.","commonSituations":"Generating a key and pasting the hex form instead of Base64; copying the key with surrounding quotes/whitespace; hand-editing the key and breaking padding; using a passphrase string directly as the key.","solutions":["Regenerate the key as 32 random bytes and Base64-encode it, e.g. `openssl rand -base64 32`, and paste exactly that value.","If your key is hex, convert to Base64: `echo <hex> | xxd -r -p | base64`.","Trim whitespace/quotes and verify padding (value length multiple of 4).","Ensure the same encoded key is used on both sender and receiver."],"exampleFix":"// before\nsecret_key = \"0123456789abcdef0123456789abcdef\" // hex, not Base64\n// after\nsecret_key = \"ASIscmWlnSPjJDvFXT4fzn9WXCFxHqcueqcbfXhz1Ro=\" // openssl rand -base64 32","handlingStrategy":"validation","validationCode":"boolean base64Ok;\ntry { Base64.getDecoder().decode(secretKey); base64Ok = true; }\ncatch (IllegalArgumentException e) { base64Ok = false; }\nif (!base64Ok) throw new IllegalArgumentException(\"secret_key is not valid Base64\");","typeGuard":null,"tryCatchPattern":"try {\n    factory.apply(config);\n} catch (OptionValidationException e) {\n    log.error(\"secret_key not Base64: {}\", e.getMessage());\n}","preventionTips":["Generate keys with `openssl rand -base64 32` — never hand-type or use hex/passphrases directly.","Paste keys without surrounding quotes/whitespace; strip copy artifacts.","Store keys in a secret manager and inject verbatim."],"tags":["config","validation","base64","encryption"],"backgroundTag":"invalid-config-value","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}