gchq/CyberChef · error · OperationError

Unable to decode JSON payload: ${e.message}

Error message

Unable to decode JSON payload: ${e.message}

What it means

Thrown by the Flask Session Decode operation when JSON.parse() fails on the decoded payload string. The base64 payload of a Flask session cookie should decode to a valid JSON object. If the decoded bytes are not parseable JSON, this error fires with the specific JSON parse failure message.

Source

Thrown at src/core/operations/FlaskSessionDecode.mjs:75

        const base64 = payloadB64.replace(/-/g, "+").replace(/_/g, "/");
        const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
        let payloadJson;
        try {
            payloadJson = fromBase64(padded);
        } catch (e) {
            throw new OperationError("Invalid Base64 payload");
        }

        try {
            let data = JSON.parse(payloadJson);

            if (args[0]) {
                data = {payload: data, timestamp: timestamp};
            }
            return data;
        } catch (e) {
            throw new OperationError("Unable to decode JSON payload: " + e.message);
        }
    }
}

export default FlaskSessionDecode;

View on GitHub (pinned to 4290ea7539)

Solutions

1. Manually decode the payload base64url segment and inspect the output to confirm it is JSON.
2. Re-capture the cookie to rule out truncation or corruption.
3. Verify the input is a genuine Flask session cookie.
4. Check the wrapped e.message for the specific JSON syntax error.

Example fix

// before: payload decodes to 'not json{{{' -> JSON.parse throws

// after: payload decodes to '{"user":"admin"}' -> valid JSON

// Pre-decode and validate JSON before passing to operation
const payload = input.trim().split('.')[0];
const b64 = payload.replace(/-/g, '+').replace(/_/g, '/');
const decoded = atob(b64.padEnd(Math.ceil(b64.length / 4) * 4, '='));
JSON.parse(decoded); // throws early if invalid

try {
  const result = chef.flaskSessionDecode(input);
} catch (e) {
  if (e.message.startsWith('Unable to decode JSON')) {
    // Payload is not valid JSON; cookie may be corrupt or non-Flask
  } else throw e;
}

When it happens

Trigger: run(input, args) at line 74 where JSON.parse(payloadJson) throws. payloadJson is the string from fromBase64(padded) and is not valid JSON.

Common situations: The payload segment decoded to non-JSON text (corrupt cookie, wrong token type, or partial decode). Also when the Flask app stores non-JSON data or the base64 decoding produced garbled output due to encoding mismatches.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Invalid Base64 payload
• Invalid Flask token format. Expected payload.timestamp.signa
• Secret key required
• Secret key required
• Invalid Flask token format. Expected payload.timestamp.signa

AI-assisted analysis of gchq/CyberChef@4290ea7539 (2026-08-13). Data as JSON: /api/errors/ca08275bbb88fed1. Report an issue: GitHub.