{"record":{"id":"6dcde0d95a011efc","repo":"gchq/CyberChef","slug":"invalid-base64-payload","errorCode":null,"errorMessage":"Invalid Base64 payload","messagePattern":"Invalid Base64 payload","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FlaskSessionDecode.mjs","lineNumber":64,"sourceCode":"        const payloadB64 = parts[0];\n        const time = parts[1];\n\n        const timeB64 = time.replace(/-/g, \"+\").replace(/_/g, \"/\");\n        const binary = fromBase64(timeB64);\n        const bytes = new Uint8Array(4);\n        for (let i = 0; i < 4; i++) {\n            bytes[i] = binary.charCodeAt(i);\n        }\n        const view = new DataView(bytes.buffer);\n        const timestamp = view.getInt32(0, false);\n\n        const base64 = payloadB64.replace(/-/g, \"+\").replace(/_/g, \"/\");\n        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\");\n        let payloadJson;\n        try {\n            payloadJson = fromBase64(padded);\n        } catch (e) {\n            throw new OperationError(\"Invalid Base64 payload\");\n        }\n\n        try {\n            let data = JSON.parse(payloadJson);\n\n            if (args[0]) {\n                data = {payload: data, timestamp: timestamp};\n            }\n            return data;\n        } catch (e) {\n            throw new OperationError(\"Unable to decode JSON payload: \" + e.message);\n        }\n    }\n}\n\nexport default FlaskSessionDecode;\n","sourceCodeStart":46,"sourceCodeEnd":81,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FlaskSessionDecode.mjs#L46-L81","documentation":"Thrown by the Flask Session Decode operation when fromBase64() fails on the URL-safe base64 payload segment. After converting URL-safe characters (-/_ ) to standard base64 (+//) and padding, the payload should decode to a UTF-8 JSON string. If the payload is not valid base64, decoding throws.","triggerScenarios":"run(input, args) at line 63 where fromBase64(padded) throws. The payload (parts[0]) after URL-safe-to-standard conversion and padding is not valid base64 data.","commonSituations":"The first segment of the cookie is corrupt, contains non-base64 characters, or is a truncated value. Also occurs if the input looked like a Flask cookie (3 parts) but is actually a different format.","solutions":["Verify the first segment is valid URL-safe base64 (characters A-Z, a-z, 0-9, -, _).","Re-capture the cookie to ensure it was not truncated during copy-paste.","Confirm the input is actually a Flask session cookie and not another 3-segment token.","Manually decode the payload segment in a base64url decoder to validate."],"exampleFix":"// before: parts[0] = 'eyJ!!!invalid!!!' -> fromBase64 throws\n\n// after: parts[0] = 'eyJ1c2VyIjoiYWRtaW4ifQ' (valid base64url JSON)","handlingStrategy":"validation","validationCode":"// Validate payload segment is decodable base64url\nconst payload = input.trim().split('.')[0];\nconst b64 = payload.replace(/-/g, '+').replace(/_/g, '/');\nconst padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, '=');\ntry { atob(padded); } catch { throw new Error('Invalid base64 payload'); }","typeGuard":"function isValidBase64UrlPayload(segment) {\n  const b64 = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, '=');\n  try { atob(padded); return true; } catch { return false; }\n}","tryCatchPattern":null,"preventionTips":["Verify the payload segment contains only base64url characters.","Re-capture cookies to avoid truncation.","Confirm the input is genuinely a Flask session cookie."],"tags":["crypto","flask","session","base64","decode-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}