{"record":{"id":"821af35a1764b37a","repo":"dutchcoders/transfer.sh","slug":"could-not-crypt-file","errorCode":null,"errorMessage":"Could not crypt file","messagePattern":"Could not crypt file","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"server/handlers.go","lineNumber":536,"sourceCode":"\n\t\t\tbuffer := &bytes.Buffer{}\n\t\t\tif err := json.NewEncoder(buffer).Encode(metadata); err != nil {\n\t\t\t\ts.logger.Printf(\"%s\", err.Error())\n\t\t\t\thttp.Error(w, \"Could not encode metadata\", http.StatusInternalServerError)\n\n\t\t\t\treturn\n\t\t\t} else if err := s.storage.Put(r.Context(), token, fmt.Sprintf(\"%s.metadata\", filename), buffer, \"text/json\", uint64(buffer.Len())); err != nil {\n\t\t\t\ts.logger.Printf(\"%s\", err.Error())\n\t\t\t\thttp.Error(w, \"Could not save metadata\", http.StatusInternalServerError)\n\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\ts.logger.Printf(\"Uploading %s %s %d %s\", token, filename, contentLength, contentType)\n\n\t\t\treader, err := attachEncryptionReader(file, r.Header.Get(\"X-Encrypt-Password\"))\n\t\t\tif err != nil {\n\t\t\t\thttp.Error(w, \"Could not crypt file\", http.StatusInternalServerError)\n\t\t\t\treturn\n\t\t\t}\n\n\t\t\tif err = s.storage.Put(r.Context(), token, filename, reader, contentType, uint64(contentLength)); err != nil {\n\t\t\t\ts.logger.Printf(\"Backend storage error: %s\", err.Error())\n\t\t\t\thttp.Error(w, err.Error(), http.StatusInternalServerError)\n\t\t\t\treturn\n\n\t\t\t}\n\n\t\t\tfilename = url.PathEscape(filename)\n\t\t\trelativeURL, _ := url.Parse(path.Join(s.proxyPath, token, filename))\n\t\t\tdeleteURL, _ := url.Parse(path.Join(s.proxyPath, token, filename, metadata.DeletionToken))\n\t\t\tw.Header().Add(\"X-Url-Delete\", resolveURL(r, deleteURL, s.proxyPort))\n\t\t\tresponseBody += fmt.Sprintln(getURL(r, s.proxyPort).ResolveReference(relativeURL).String())\n\t\t}\n\t}\n\t_, err := w.Write([]byte(responseBody))","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/dutchcoders/transfer.sh/blob/c37bfd95797fd6da8a6da53fc13d191994b3f687/server/handlers.go#L518-L554","documentation":"postHandler calls attachEncryptionReader(file, r.Header.Get(\"X-Encrypt-Password\")) to wrap the file in an AES-GCM encryption reader when the X-Encrypt-Password header is present. If deriving the key or initializing the cipher fails, the server responds with 500 and this message. The upload is aborted before anything is written to the storage backend for the file body.","triggerScenarios":"A request sets the X-Encrypt-Password header and attachEncryptionReader fails while initializing AES-GCM (key/cipher setup error). Empty or pathological header values combined with code changes to key derivation can also trigger it.","commonSituations":"Clients using encryption incorrectly with a modified or older server version where password handling differs; programmatic clients sending an empty X-Encrypt-Password header value (present but empty) and hitting edge cases in key setup.","solutions":["Ensure the X-Encrypt-Password header carries a non-empty, reasonable-length password.","Omit the header entirely if you do not want encryption instead of sending it empty.","Use the matching client library/version whose key derivation agrees with the server.","Retry with a corrected header; no partial file was stored (though the .metadata object may already exist)."],"exampleFix":"// before: header present but empty\nreq.Header.Set(\"X-Encrypt-Password\", \"\")\n// after: send a real password or omit the header\nreq.Header.Set(\"X-Encrypt-Password\", \"correct horse battery staple\")","handlingStrategy":"validation","validationCode":"// Ensure the encryption header is well-formed before sending\nfunc encryptionHeaderValid(password string) bool {\n    return password != \"\" && len(password) >= 8\n}\n// only set header when valid\nif encryptionHeaderValid(pw) {\n    req.Header.Set(\"X-Encrypt-Password\", pw)\n}","typeGuard":null,"tryCatchPattern":"resp, err := http.Post(url, mime, body)\nif err == nil && resp.StatusCode == http.StatusInternalServerError &&\n    strings.Contains(readBody(resp), \"Could not crypt file\") {\n    return fmt.Errorf(\"encryption handshake failed; check X-Encrypt-Password header\")\n}","preventionTips":["Only send X-Encrypt-Password with a non-empty password; omit it otherwise.","Use the matching official client so key derivation agrees with the server.","Keep server and client versions in sync for encryption features.","Remember the download side needs the same password to decrypt."],"tags":["encryption","aes-gcm","http","server","upload"],"backgroundTag":"encryption-init-failed","analyzedSha":"c37bfd95797fd6da8a6da53fc13d191994b3f687","analyzedAt":"2026-09-05T10:21:07.548Z","contentChangedAt":"2026-09-05T10:21:07.548Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}