{"record":{"id":"a6dd367dfc705d72","repo":"w7corp/easywechat","slug":"the-given-payload-is-invalid-s","errorCode":null,"errorMessage":"The given payload is invalid: %s","messagePattern":"The given payload is invalid: (.+?)","errorType":"exception","errorClass":"DecryptException","httpStatus":null,"severity":"error","filePath":"src/MiniApp/Decryptor.php","lineNumber":38,"sourceCode":"     *\n     * @throws DecryptException\n     */\n    public static function decrypt(string $sessionKey, string $iv, string $ciphertext): array\n    {\n        try {\n            $decrypted = AesCbc::decrypt(\n                $ciphertext,\n                base64_decode($sessionKey, false),\n                base64_decode($iv, false)\n            );\n\n            $decrypted = json_decode($decrypted, true);\n\n            if (! $decrypted || ! is_array($decrypted)) {\n                throw new DecryptException('The given payload is invalid.');\n            }\n        } catch (Throwable $e) {\n            throw new DecryptException(sprintf('The given payload is invalid: %s', $e->getMessage()));\n        }\n\n        return $decrypted;\n    }\n}\n","sourceCodeStart":20,"sourceCodeEnd":44,"githubUrl":"https://github.com/w7corp/easywechat/blob/f0cf0a8b8361417ed683b8246d0ecbaf0aafcaa8/src/MiniApp/Decryptor.php#L20-L44","documentation":"Any failure inside MiniApp\\Decryptor::decrypt() — AesCbc::decrypt throwing (wrong sessionKey/iv or corrupted ciphertext fails the AES-128-CBC padding check) or json_decode not yielding an array — is re-thrown as this DecryptException with the underlying message appended. It is the standard failure when decrypting wx.getUserProfile/getPhoneNumber-style encryptedData, and in practice almost always means the sessionKey does not correspond to the encryptedData being decrypted.","triggerScenarios":"Using a stale session_key (the user logged in again, so code2Session issued a new one); iv from a different client call than encryptedData; appid of the issuing client different from the configured MiniApp; ciphertext/iv corrupted or URL-decoded so base64 padding was stripped.","commonSituations":"Calling code2Session twice and keeping the first session_key; session_key cached under a wrong or shared key across users; test data generated in dev tools used against production credentials; GET-parameter truncation of trailing '=' characters.","solutions":["Re-run codeToSession with a fresh code and retry decryption with the new session_key.","Persist session_key keyed by openid and refresh it on every login.","Verify the appid matches the mini program that produced the data.","Check iv base64-decodes to 16 bytes and encryptedData is the untouched client string."],"exampleFix":"// before: decrypting with a session_key from an earlier login\n$data = Decryptor::decrypt($oldSessionKey, $iv, $encryptedData);\n// after: refresh via code2Session on failure and retry once\ntry {\n    $data = Decryptor::decrypt($sessionKey, $iv, $encryptedData);\n} catch (DecryptException $e) {\n    $session = $app->getUtils()->codeToSession($code);\n    Cache::put(\"sk:{$session['openid']}\", $session['session_key'], 300);\n    $data = Decryptor::decrypt($session['session_key'], $iv, $encryptedData);\n}","handlingStrategy":"retry","validationCode":"if (strlen((string) base64_decode($sessionKey, true)) !== 24) { throw new InvalidArgumentException('session_key must base64-decode to 24 bytes'); }\nif (strlen((string) base64_decode($iv, true)) !== 16) { throw new InvalidArgumentException('iv must base64-decode to 16 bytes'); }","typeGuard":null,"tryCatchPattern":"try { $data = \\EasyWeChat\\MiniApp\\Decryptor::decrypt($sessionKey, $iv, $encryptedData); } catch (\\EasyWeChat\\Kernel\\Exceptions\\DecryptException $e) { // one controlled retry with a refreshed session_key $fresh = $app->getUtils()->codeToSession($code); return \\EasyWeChat\\MiniApp\\Decryptor::decrypt($fresh['session_key'], $iv, $encryptedData); }","preventionTips":["Treat session_key as volatile: refresh it on every login","Use one cache key per openid for session_key","Have the client fetch encryptedData+iv together with a fresh login code"],"tags":["php","miniapp","decryption","session-key","encrypted-data"],"backgroundTag":"session-key-mismatch","analyzedSha":"f0cf0a8b8361417ed683b8246d0ecbaf0aafcaa8","analyzedAt":"2026-08-21T05:29:19.565Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}