gchq/CyberChef · error · OperationError

Secret key required

Error message

Secret key required

What it means

Thrown by the Flask Session Verify operation when the secret key argument (args[0].string) is empty/falsy. Verifying a Flask session cookie's HMAC signature requires the same secret key used to sign it. Without the key, the HMAC cannot be recomputed for comparison.

Source

Thrown at src/core/operations/FlaskSessionVerify.mjs:61

                value: ["sha1", "sha256"],
            },
            {
                name: "View TimeStamp",
                type: "boolean",
                value: true
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {

        if (!args[0].string) {
            throw new OperationError("Secret key required");
        }

        const key = Utils.convertToByteString(args[0].string, args[0].option);
        const salt = Utils.convertToByteString(args[1].string || "cookie-session", args[1].option);
        const algorithm = args[2] || "sha1";

        input = input.trim();

        const parts = input.split(".");

        if (parts.length !== 3) {
            throw new OperationError("Invalid Flask token format. Expected payload.timestamp.signature");
        }

        const data = Utils.convertToByteString(parts[0] + "." + parts[1], "utf8");


        const derivedKey = CryptoApi.getHmac(key, CryptoApi.getHasher(algorithm));

View on GitHub (pinned to 4290ea7539)

Solutions

1. Enter the Flask application's SECRET_KEY that was used to sign the cookie.
2. Select the correct key encoding (Hex, UTF8, Base64, etc.) matching how the key is stored.
3. Retrieve the SECRET_KEY from the Flask app configuration.

Example fix

// before: args[0] = {string: '', option: 'UTF8'} -> error

// after: args[0] = {string: 'my-secret-key-123', option: 'UTF8'}

// Ensure key is non-empty before calling FlaskSessionVerify
if (!args[0] || !args[0].string || !args[0].string.trim()) {
  throw new Error('A non-empty secret key is required');
}

function hasSecretKey(keyArg) {
  return keyArg && typeof keyArg.string === 'string' && keyArg.string.trim().length > 0;
}

When it happens

Trigger: run(input, args) at line 60 where !args[0].string is true. The 'Key' toggleString argument has an empty string value.

Common situations: User leaves the Key field blank when attempting to verify a session cookie. The key encoding toggle may be set but the string value is empty.

Related errors

• Secret key required
• Invalid Flask token format. Expected payload.timestamp.signa
• Invalid Base64 payload
• Unable to decode JSON payload: ${e.message}
• Invalid Flask token format. Expected payload.timestamp.signa

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/5077191741ad16c2. Report an issue: GitHub.