gchq/CyberChef · error · OperationError

Secret key required

Error message

Secret key required

What it means

Thrown by the Flask Session Verify operation when the secret key argument (args[0].string) is empty/falsy. Verifying a Flask session cookie's HMAC signature requires the same secret key used to sign it. Without the key, the HMAC cannot be recomputed for comparison.

Solutions

1. Enter the Flask application's SECRET_KEY that was used to sign the cookie.
2. Select the correct key encoding (Hex, UTF8, Base64, etc.) matching how the key is stored.
3. Retrieve the SECRET_KEY from the Flask app configuration.

Example fix

// before: args[0] = {string: '', option: 'UTF8'} -> error

// after: args[0] = {string: 'my-secret-key-123', option: 'UTF8'}

// Ensure key is non-empty before calling FlaskSessionVerify
if (!args[0] || !args[0].string || !args[0].string.trim()) {
  throw new Error('A non-empty secret key is required');
}

function hasSecretKey(keyArg) {
  return keyArg && typeof keyArg.string === 'string' && keyArg.string.trim().length > 0;
}

When it happens

Trigger: run(input, args) at line 60 where !args[0].string is true. The 'Key' toggleString argument has an empty string value.

Common situations: User leaves the Key field blank when attempting to verify a session cookie. The key encoding toggle may be set but the string value is empty.

Related errors

• Secret key required
• Invalid Base64 payload
• Invalid Flask token format. Expected…
• Invalid Flask token format. Expected…
• Invalid signature!

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/5077191741ad16c2. Report an issue: GitHub.

Appendix: source

Thrown at src/core/operations/FlaskSessionVerify.mjs:61

                value: ["sha1", "sha256"],
            },
            {
                name: "View TimeStamp",
                type: "boolean",
                value: true
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {

        if (!args[0].string) {
            throw new OperationError("Secret key required");
        }

        const key = Utils.convertToByteString(args[0].string, args[0].option);
        const salt = Utils.convertToByteString(args[1].string || "cookie-session", args[1].option);
        const algorithm = args[2] || "sha1";

        input = input.trim();

        const parts = input.split(".");

        if (parts.length !== 3) {
            throw new OperationError("Invalid Flask token format. Expected payload.timestamp.signature");
        }

        const data = Utils.convertToByteString(parts[0] + "." + parts[1], "utf8");


        const derivedKey = CryptoApi.getHmac(key, CryptoApi.getHasher(algorithm));

View on GitHub (pinned to 4290ea7539)