{"record":{"id":"ca08275bbb88fed1","repo":"gchq/CyberChef","slug":"unable-to-decode-json-payload-e-message","errorCode":null,"errorMessage":"Unable to decode JSON payload: ${e.message}","messagePattern":"Unable to decode JSON payload: (.+?)","errorType":"exception","errorClass":"OperationError","httpStatus":null,"severity":"error","filePath":"src/core/operations/FlaskSessionDecode.mjs","lineNumber":75,"sourceCode":"\n        const base64 = payloadB64.replace(/-/g, \"+\").replace(/_/g, \"/\");\n        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, \"=\");\n        let payloadJson;\n        try {\n            payloadJson = fromBase64(padded);\n        } catch (e) {\n            throw new OperationError(\"Invalid Base64 payload\");\n        }\n\n        try {\n            let data = JSON.parse(payloadJson);\n\n            if (args[0]) {\n                data = {payload: data, timestamp: timestamp};\n            }\n            return data;\n        } catch (e) {\n            throw new OperationError(\"Unable to decode JSON payload: \" + e.message);\n        }\n    }\n}\n\nexport default FlaskSessionDecode;\n","sourceCodeStart":57,"sourceCodeEnd":81,"githubUrl":"https://github.com/gchq/CyberChef/blob/4290ea753912378913b1f3f54e0fc5720afeda5d/src/core/operations/FlaskSessionDecode.mjs#L57-L81","documentation":"Thrown by the Flask Session Decode operation when JSON.parse() fails on the decoded payload string. The base64 payload of a Flask session cookie should decode to a valid JSON object. If the decoded bytes are not parseable JSON, this error fires with the specific JSON parse failure message.","triggerScenarios":"run(input, args) at line 74 where JSON.parse(payloadJson) throws. payloadJson is the string from fromBase64(padded) and is not valid JSON.","commonSituations":"The payload segment decoded to non-JSON text (corrupt cookie, wrong token type, or partial decode). Also when the Flask app stores non-JSON data or the base64 decoding produced garbled output due to encoding mismatches.","solutions":["Manually decode the payload base64url segment and inspect the output to confirm it is JSON.","Re-capture the cookie to rule out truncation or corruption.","Verify the input is a genuine Flask session cookie.","Check the wrapped e.message for the specific JSON syntax error."],"exampleFix":"// before: payload decodes to 'not json{{{' -> JSON.parse throws\n\n// after: payload decodes to '{\"user\":\"admin\"}' -> valid JSON","handlingStrategy":"try-catch","validationCode":"// Pre-decode and validate JSON before passing to operation\nconst payload = input.trim().split('.')[0];\nconst b64 = payload.replace(/-/g, '+').replace(/_/g, '/');\nconst decoded = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, '='));\nJSON.parse(decoded); // throws early if invalid","typeGuard":null,"tryCatchPattern":"try {\n  const result = chef.flaskSessionDecode(input);\n} catch (e) {\n  if (e.message.startsWith('Unable to decode JSON')) {\n    // Payload is not valid JSON; cookie may be corrupt or non-Flask\n  } else throw e;\n}","preventionTips":["Manually decode the payload to verify it is JSON.","Ensure the cookie was not truncated.","Confirm the cookie is from a Flask application."],"tags":["crypto","flask","session","json","decode-error"],"backgroundTag":null,"analyzedSha":"4290ea753912378913b1f3f54e0fc5720afeda5d","analyzedAt":"2026-08-13T06:05:50.210Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}