gchq/CyberChef · error · OperationError

Invalid Flask token format. Expected payload.timestamp.signa

Error message

Invalid Flask token format. Expected payload.timestamp.signature

What it means

Thrown by the Flask Session Decode operation when the input string does not split into exactly three dot-separated parts. Flask session cookies (itsdangerous) follow the format: base64url(payload).base64url(timestamp).base64url(signature). A different number of segments means the input is not a valid Flask session cookie.

Source

Thrown at src/core/operations/FlaskSessionDecode.mjs:43

        this.args = [
            {
                name: "View TimeStamp",
                type: "boolean",
                value: false
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {Object[]}
     */
    run(input, args) {
        input = input.trim();
        const parts = input.split(".");
        if (parts.length !== 3) {
            throw new OperationError("Invalid Flask token format. Expected payload.timestamp.signature");
        }

        const payloadB64 = parts[0];
        const time = parts[1];

        const timeB64 = time.replace(/-/g, "+").replace(/_/g, "/");
        const binary = fromBase64(timeB64);
        const bytes = new Uint8Array(4);
        for (let i = 0; i < 4; i++) {
            bytes[i] = binary.charCodeAt(i);
        }
        const view = new DataView(bytes.buffer);
        const timestamp = view.getInt32(0, false);

        const base64 = payloadB64.replace(/-/g, "+").replace(/_/g, "/");
        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
        let payloadJson;
        try {

View on GitHub (pinned to 4290ea7539)

Solutions

1. Verify the input is a Flask session cookie with exactly two dots separating three base64url segments.
2. Capture the cookie from browser DevTools > Application > Cookies for a Flask-based site.
3. Remove any surrounding quotes, whitespace, or encoding artifacts.
4. If the cookie has a 'session=' prefix, strip it to just the token value.

Example fix

// before: input = 'eyJ1c2VyIjoiYWRtaW4ifQ' (only 1 segment)

// after: input = 'eyJ1c2VyIjoiYWRtaW4ifQ.Zmxhc2s=.abc123sig'
//         (payload.timestamp.signature)

// Validate Flask cookie has 3 dot-separated segments
const parts = input.trim().split('.');
if (parts.length !== 3) {
  throw new Error('Input must be payload.timestamp.signature');
}

function isFlaskCookieFormat(str) {
  const parts = str.trim().split('.');
  return parts.length === 3 && parts.every(p => p.length > 0);
}

When it happens

Trigger: run(input, args) at line 42 where input.trim().split('.').length !== 3. This occurs when the input has fewer or more than two dots.

Common situations: Pasting a JWT (which has 3 segments but different structure), a Django session cookie, a random string, or a Flask cookie that has been truncated/corrupted. Also when extra whitespace or newlines affect splitting.

Related errors

• Invalid Flask token format. Expected payload.timestamp.signa
• Invalid Base64 payload
• Unable to decode JSON payload: ${e.message}
• Secret key required
• Secret key required

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/9a5fb114a462ef29. Report an issue: GitHub.