appsmithorg/appsmith · error · AppsmithPluginException

PE-DSE-5003

PE-DSE-5003

Error message

Secret key is required when sending session details is switched on, and should be at least 32 characters in length.

What it means

Thrown by HeaderUtils.getSignatureKey when 'send session details' is enabled (IS_SEND_SESSION_ENABLED_KEY == 'Y') but the configured SESSION_SIGNATURE_KEY_KEY is empty or shorter than 32 characters. The session-signing feature uses this secret to sign session data sent to the upstream API, so a missing/weak key is treated as a configuration error (PLUGIN_DATASOURCE_ARGUMENT_ERROR).

Source

Thrown at app/server/appsmith-interfaces/src/main/java/com/appsmith/external/helpers/restApiUtils/helpers/HeaderUtils.java:122

        return null;
    }

    public String getSignatureKey(DatasourceConfiguration datasourceConfiguration) throws AppsmithPluginException {
        if (!isEmpty(datasourceConfiguration.getProperties())) {
            boolean isSendSessionEnabled = false;
            String secretKey = null;

            for (Property property : datasourceConfiguration.getProperties()) {
                if (IS_SEND_SESSION_ENABLED_KEY.equals(property.getKey())) {
                    isSendSessionEnabled = "Y".equals(property.getValue());
                } else if (SESSION_SIGNATURE_KEY_KEY.equals(property.getKey())) {
                    secretKey = (String) property.getValue();
                }
            }

            if (isSendSessionEnabled) {
                if (StringUtils.isEmpty(secretKey) || secretKey.length() < 32) {
                    throw new AppsmithPluginException(
                            AppsmithPluginError.PLUGIN_DATASOURCE_ARGUMENT_ERROR,
                            "Secret key is required when sending session details is switched on,"
                                    + " and should be at least 32 characters in length.");
                }
                return secretKey;
            }
        }

        return null;
    }

    public void setHeaderFromAutoGeneratedHeaders(ActionConfiguration actionConfiguration) {
        if (isEmpty(actionConfiguration.getAutoGeneratedHeaders())) {
            return;
        }

        if (isEmpty(actionConfiguration.getHeaders())) {
            actionConfiguration.setHeaders(actionConfiguration.getAutoGeneratedHeaders());

View on GitHub (pinned to 8cd9021c24)

Solutions

1. Generate a secret at least 32 characters long, e.g. openssl rand -base64 48, and paste it into the session signature key field.
2. Disable the 'send session details' toggle if you do not need signed session propagation.
3. Store the secret in the datasource configuration via the Appsmith UI so it is persisted encrypted.

Example fix

# generate a 32+ char secret
openssl rand -base64 48
# paste the output into the 'Session Signature Key' datasource field

boolean sendEnabled = /* read IS_SEND_SESSION_ENABLED_KEY */;
String secret = /* read SESSION_SIGNATURE_KEY_KEY */;
if (sendEnabled) {
    if (secret == null || secret.trim().isEmpty() || secret.length() < 32) {
        throw new IllegalArgumentException("Session signature key must be at least 32 characters when session sending is on");
    }
}
// safe to call headerUtils.getSignatureKey

public static boolean isValidSessionSecret(String s) {
    return s != null && !s.trim().isEmpty() && s.length() >= 32;
}

try {
    String secret = headerUtils.getSignatureKey(dsConfig);
} catch (AppsmithPluginException e) {
    if (e.getError() == AppsmithPluginError.PLUGIN_DATASOURCE_ARGUMENT_ERROR) {
        // prompt user to set or lengthen the secret, or disable session sending
        throw new IllegalArgumentException("Set a 32+ char session signature key or disable session sending", e);
    }
    throw e;
}

When it happens

Trigger: Enabling the 'send session details' toggle on a datasource without setting a signature secret, or setting one shorter than 32 chars. Each request that needs the session signature calls getSignatureKey, so the error fires on the first such request.

Common situations: User toggles session sending but never fills the secret field; secret was set to a short password; secret field cleared during an edit; copying a datasource template that did not include the secret.

Related errors

• The ${path} path must start with 'https://'.
• Please enter a target origin URL.
• PE-DSE-5003
• error
• resetWidget expected STRING for 'widgetName' argument but re

AI-assisted analysis of appsmithorg/appsmith@8cd9021c24 (2026-08-12). Data as JSON: /api/errors/9d59493dc1e8840d. Report an issue: GitHub.