beego/beego · error

Decode: invalid value format

Error message

Decode: invalid value format

What it means

decodeCookie (server/web/session/sess_utils.go:152) base64-decodes the cookie value and splits on '|' expecting exactly three parts: date|value|mac. Any other shape means the value was not produced by beego's encodeCookie, so its format is declared invalid before MAC or timestamp checks run.

Source

Thrown at server/web/session/sess_utils.go:152

	sig := h.Sum(nil)
	// Append mac, remove name.
	b = append(b, sig...)[len(name)+1:]
	// 4. Encode to base64.
	b = encode(b)
	// Done.
	return string(b), nil
}

func decodeCookie(block cipher.Block, hashKey, name, value string, gcmaxlifetime int64) (map[interface{}]interface{}, error) {
	// 1. Decode from base64.
	b, err := decode([]byte(value))
	if err != nil {
		return nil, err
	}
	// 2. Verify MAC. Value is "date|value|mac".
	parts := bytes.SplitN(b, []byte("|"), 3)
	if len(parts) != 3 {
		return nil, errors.New("Decode: invalid value format")
	}

	b = append([]byte(name+"|"), b[:len(b)-len(parts[2])]...)
	h := hmac.New(sha256.New, []byte(hashKey))
	h.Write(b)
	sig := h.Sum(nil)
	if len(sig) != len(parts[2]) || subtle.ConstantTimeCompare(sig, parts[2]) != 1 {
		return nil, errors.New("Decode: the value is not valid")
	}
	// 3. Verify date ranges.
	var t1 int64
	if t1, err = strconv.ParseInt(string(parts[0]), 10, 64); err != nil {
		return nil, errors.New("Decode: invalid timestamp")
	}
	t2 := time.Now().UTC().Unix()
	if t1 > t2 {
		return nil, errors.New("Decode: timestamp is too new")
	}

View on GitHub (pinned to 939cfde380)

Solutions

1. Clear the session cookie client-side and obtain a fresh one
2. Use a distinct SessionName per app/environment so foreign values never reach decodeCookie
3. Avoid rewriting Cookie headers in proxies; pass them through verbatim

kv, err := decodeCookie(block, hashKey, name, value, gcmaxlifetime)
if err != nil {
    switch {
    case strings.Contains(err.Error(), "invalid value format"):
        // foreign or mangled cookie: discard, do not 500
        clearSessionCookie(w, name)
        kv = map[interface{}]interface{}{}
    default:
        return err
    }
}

When it happens

Trigger: A foreign or hand-crafted cookie arriving under the session cookie name; a value mangled so a '|' disappeared (double URL-decoding, truncation at a gateway); switching session providers while old-format cookies linger in browsers.

Common situations: Another framework (or an older beego layout) using the same cookie name on the same domain; proxy rewrites corrupting the value; manual cookie editing during debugging.

Related errors

• Decode: invalid timestamp
• length of the sid is less than 2
• min length of session id is 2
• decrypt: the value could not be decrypted
• Decode: the value is not valid

AI-assisted analysis of beego/beego@939cfde380 (2026-08-15). Data as JSON: /api/errors/4fbfe93c494d9d14. Report an issue: GitHub.