gchq/CyberChef · error · OperationError

Secret key required

Error message

Secret key required

What it means

Thrown by the Flask Session Sign operation when the secret key argument (args[0].string) is empty/falsy. Signing a Flask session cookie requires a secret key to compute the HMAC. Without it, the itsdangerous-derived signature cannot be generated.

Source

Thrown at src/core/operations/FlaskSessionSign.mjs:55

                value: "cookie-session",
                toggleValues: ["UTF8", "Hex", "Decimal", "Binary", "Base64", "Latin1"]
            },
            {
                name: "Algorithm",
                type: "option",
                value: ["sha1", "sha256"],
            }
        ];
    }

    /**
     * @param {string} input
     * @param {Object[]} args
     * @returns {string}
     */
    run(input, args) {
        if (!args[0].string) {
            throw new OperationError("Secret key required");
        }
        const key = Utils.convertToByteString(args[0].string, args[0].option);
        const salt = Utils.convertToByteString(args[1].string || "cookie-session", args[1].option);
        const algorithm = args[2] || "sha1";

        const payloadB64 = toBase64(Utils.strToByteArray(JSON.stringify(input)));
        const payload = payloadB64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");

        const derivedKey = CryptoApi.getHmac(key, CryptoApi.getHasher(algorithm));
        derivedKey.update(salt);

        const currentTimeStamp = Math.ceil(Date.now() / 1000);
        const buffer = new ArrayBuffer(4);
        const view = new DataView(buffer);
        view.setInt32(0, currentTimeStamp, false);
        const bytes = new Uint8Array(buffer);
        let binary = "";
        bytes.forEach(b => binary += String.fromCharCode(b));

View on GitHub (pinned to 4290ea7539)

Solutions

1. Enter the Flask application's SECRET_KEY in the 'Key' argument field.
2. Select the correct key encoding (Hex, UTF8, Base64, etc.) via the toggle.
3. Retrieve the SECRET_KEY from the Flask app's configuration (app.config['SECRET_KEY']).

Example fix

// before: args[0] = {string: '', option: 'UTF8'} -> error

// after: args[0] = {string: 'my-secret-key-123', option: 'UTF8'}

// Ensure key is non-empty before calling FlaskSessionSign
if (!args[0] || !args[0].string || !args[0].string.trim()) {
  throw new Error('A non-empty secret key is required');
}

function hasSecretKey(keyArg) {
  return keyArg && typeof keyArg.string === 'string' && keyArg.string.trim().length > 0;
}

When it happens

Trigger: run(input, args) at line 54 where !args[0].string is true. The 'Key' toggleString argument has an empty string value.

Common situations: User leaves the Key field blank, or the key was accidentally cleared when modifying the recipe. The toggleString arg structure has {string, option} and only string is checked.

Related errors

• Secret key required
• Invalid Flask token format. Expected payload.timestamp.signa
• Invalid Base64 payload
• Unable to decode JSON payload: ${e.message}
• Invalid Flask token format. Expected payload.timestamp.signa

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/83d1b383f92ffc1f. Report an issue: GitHub.