{"record":{"id":"9d59493dc1e8840d","repo":"appsmithorg/appsmith","slug":"pe-dse-5003-9d5949","errorCode":"PE-DSE-5003","errorMessage":"Secret key is required when sending session details is switched on, and should be at least 32 characters in length.","messagePattern":"Secret key is required when sending session details is switched on, and should be at least 32 characters in length\\.","errorType":"error_code","errorClass":"AppsmithPluginException","httpStatus":500,"severity":"error","filePath":"app/server/appsmith-interfaces/src/main/java/com/appsmith/external/helpers/restApiUtils/helpers/HeaderUtils.java","lineNumber":122,"sourceCode":"        return null;\n    }\n\n    public String getSignatureKey(DatasourceConfiguration datasourceConfiguration) throws AppsmithPluginException {\n        if (!isEmpty(datasourceConfiguration.getProperties())) {\n            boolean isSendSessionEnabled = false;\n            String secretKey = null;\n\n            for (Property property : datasourceConfiguration.getProperties()) {\n                if (IS_SEND_SESSION_ENABLED_KEY.equals(property.getKey())) {\n                    isSendSessionEnabled = \"Y\".equals(property.getValue());\n                } else if (SESSION_SIGNATURE_KEY_KEY.equals(property.getKey())) {\n                    secretKey = (String) property.getValue();\n                }\n            }\n\n            if (isSendSessionEnabled) {\n                if (StringUtils.isEmpty(secretKey) || secretKey.length() < 32) {\n                    throw new AppsmithPluginException(\n                            AppsmithPluginError.PLUGIN_DATASOURCE_ARGUMENT_ERROR,\n                            \"Secret key is required when sending session details is switched on,\"\n                                    + \" and should be at least 32 characters in length.\");\n                }\n                return secretKey;\n            }\n        }\n\n        return null;\n    }\n\n    public void setHeaderFromAutoGeneratedHeaders(ActionConfiguration actionConfiguration) {\n        if (isEmpty(actionConfiguration.getAutoGeneratedHeaders())) {\n            return;\n        }\n\n        if (isEmpty(actionConfiguration.getHeaders())) {\n            actionConfiguration.setHeaders(actionConfiguration.getAutoGeneratedHeaders());","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/appsmithorg/appsmith/blob/8cd9021c24cdbea1c3c12c966073708e83db60c2/app/server/appsmith-interfaces/src/main/java/com/appsmith/external/helpers/restApiUtils/helpers/HeaderUtils.java#L104-L140","documentation":"Thrown by HeaderUtils.getSignatureKey when 'send session details' is enabled (IS_SEND_SESSION_ENABLED_KEY == 'Y') but the configured SESSION_SIGNATURE_KEY_KEY is empty or shorter than 32 characters. The session-signing feature uses this secret to sign session data sent to the upstream API, so a missing/weak key is treated as a configuration error (PLUGIN_DATASOURCE_ARGUMENT_ERROR).","triggerScenarios":"Enabling the 'send session details' toggle on a datasource without setting a signature secret, or setting one shorter than 32 chars. Each request that needs the session signature calls getSignatureKey, so the error fires on the first such request.","commonSituations":"User toggles session sending but never fills the secret field; secret was set to a short password; secret field cleared during an edit; copying a datasource template that did not include the secret.","solutions":["Generate a secret at least 32 characters long, e.g. openssl rand -base64 48, and paste it into the session signature key field.","Disable the 'send session details' toggle if you do not need signed session propagation.","Store the secret in the datasource configuration via the Appsmith UI so it is persisted encrypted."],"exampleFix":"# generate a 32+ char secret\nopenssl rand -base64 48\n# paste the output into the 'Session Signature Key' datasource field","handlingStrategy":"validation","validationCode":"boolean sendEnabled = /* read IS_SEND_SESSION_ENABLED_KEY */;\nString secret = /* read SESSION_SIGNATURE_KEY_KEY */;\nif (sendEnabled) {\n    if (secret == null || secret.trim().isEmpty() || secret.length() < 32) {\n        throw new IllegalArgumentException(\"Session signature key must be at least 32 characters when session sending is on\");\n    }\n}\n// safe to call headerUtils.getSignatureKey","typeGuard":"public static boolean isValidSessionSecret(String s) {\n    return s != null && !s.trim().isEmpty() && s.length() >= 32;\n}","tryCatchPattern":"try {\n    String secret = headerUtils.getSignatureKey(dsConfig);\n} catch (AppsmithPluginException e) {\n    if (e.getError() == AppsmithPluginError.PLUGIN_DATASOURCE_ARGUMENT_ERROR) {\n        // prompt user to set or lengthen the secret, or disable session sending\n        throw new IllegalArgumentException(\"Set a 32+ char session signature key or disable session sending\", e);\n    }\n    throw e;\n}","preventionTips":["Generate the secret with openssl rand -base64 48.","Disable session sending if signing is not required.","Validate secret length in the datasource form before save."],"tags":["security","session","secret-key","rest-api","datasource-config","validation"],"backgroundTag":null,"analyzedSha":"8cd9021c24cdbea1c3c12c966073708e83db60c2","analyzedAt":"2026-08-12T22:14:19.293Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}