{"record":{"id":"83d1b383f92ffc1f","repo":"gchq/CyberChef","slug":"secret-key-required","errorCode":null,"errorMessage":"Secret key required","messagePattern":"Secret key required","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FlaskSessionSign.mjs","lineNumber":55,"sourceCode":"                value: \"cookie-session\",\n                toggleValues: [\"UTF8\", \"Hex\", \"Decimal\", \"Binary\", \"Base64\", \"Latin1\"]\n            },\n            {\n                name: \"Algorithm\",\n                type: \"option\",\n                value: [\"sha1\", \"sha256\"],\n            }\n        ];\n    }\n\n    /**\n     * @param {string} input\n     * @param {Object[]} args\n     * @returns {string}\n     */\n    run(input, args) {\n        if (!args[0].string) {\n            throw new OperationError(\"Secret key required\");\n        }\n        const key = Utils.convertToByteString(args[0].string, args[0].option);\n        const salt = Utils.convertToByteString(args[1].string || \"cookie-session\", args[1].option);\n        const algorithm = args[2] || \"sha1\";\n\n        const payloadB64 = toBase64(Utils.strToByteArray(JSON.stringify(input)));\n        const payload = payloadB64.replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n\n        const derivedKey = CryptoApi.getHmac(key, CryptoApi.getHasher(algorithm));\n        derivedKey.update(salt);\n\n        const currentTimeStamp = Math.ceil(Date.now() / 1000);\n        const buffer = new ArrayBuffer(4);\n        const view = new DataView(buffer);\n        view.setInt32(0, currentTimeStamp, false);\n        const bytes = new Uint8Array(buffer);\n        let binary = \"\";\n        bytes.forEach(b => binary += String.fromCharCode(b));","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FlaskSessionSign.mjs#L37-L73","documentation":"Thrown by the Flask Session Sign operation when the secret key argument (args[0].string) is empty/falsy. Signing a Flask session cookie requires a secret key to compute the HMAC. Without it, the itsdangerous-derived signature cannot be generated.","triggerScenarios":"run(input, args) at line 54 where !args[0].string is true. The 'Key' toggleString argument has an empty string value.","commonSituations":"User leaves the Key field blank, or the key was accidentally cleared when modifying the recipe. The toggleString arg structure has {string, option} and only string is checked.","solutions":["Enter the Flask application's SECRET_KEY in the 'Key' argument field.","Select the correct key encoding (Hex, UTF8, Base64, etc.) via the toggle.","Retrieve the SECRET_KEY from the Flask app's configuration (app.config['SECRET_KEY'])."],"exampleFix":"// before: args[0] = {string: '', option: 'UTF8'} -> error\n\n// after: args[0] = {string: 'my-secret-key-123', option: 'UTF8'}","handlingStrategy":"validation","validationCode":"// Ensure key is non-empty before calling FlaskSessionSign\nif (!args[0] || !args[0].string || !args[0].string.trim()) {\n  throw new Error('A non-empty secret key is required');\n}","typeGuard":"function hasSecretKey(keyArg) {\n  return keyArg && typeof keyArg.string === 'string' && keyArg.string.trim().length > 0;\n}","tryCatchPattern":null,"preventionTips":["Always provide the Flask SECRET_KEY value.","Select the correct key encoding toggle.","Retrieve the key from the app's configuration."],"tags":["crypto","flask","session","hmac","key-required"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}