{"record":{"id":"a8d41da7199f5ca8","repo":"t8y2/dbx","slug":"invalid-disablepafxfast-option-w","errorCode":null,"errorMessage":"invalid disablepafxfast option: %w","messagePattern":"invalid disablepafxfast option: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/cassandra-go/config.go","lineNumber":321,"sourceCode":"\t\t\tconfig.kerberos.realm = value\n\t\tcase \"kerberoskeytab\", \"keytab\":\n\t\t\tconfig.kerberos.keytabPath = value\n\t\tcase \"kerberosccache\", \"kerberosticketcache\", \"ccache\", \"ticketcache\":\n\t\t\tconfig.kerberos.ccachePath = value\n\t\tcase \"kerberospassword\":\n\t\t\tconfig.kerberos.password = value\n\t\tcase \"kerberosservice\", \"kerberosservicename\", \"saslprotocol\":\n\t\t\tconfig.kerberos.serviceName = value\n\t\tcase \"kerberosservername\", \"saslservername\":\n\t\t\tconfig.kerberos.serverName = value\n\t\tcase \"kerberosauthorizationid\", \"authorizationid\":\n\t\t\tconfig.kerberos.authorizationID = value\n\t\tcase \"kerberosqop\", \"saslqop\":\n\t\t\tconfig.kerberos.qop = value\n\t\tcase \"kerberosdisablepafxfast\", \"disablepafxfast\":\n\t\t\tdisabled, err := strconv.ParseBool(value)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid disablepafxfast option: %w\", err)\n\t\t\t}\n\t\t\tconfig.kerberos.disablePAFXFAST = disabled\n\t\tcase \"kerberosusekeytab\", \"usekeytab\":\n\t\t\tenabled, err := strconv.ParseBool(value)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid usekeytab option: %w\", err)\n\t\t\t}\n\t\t\tconfig.kerberos.useKeytab = enabled\n\t\t\tconfig.kerberos.useKeytabSet = true\n\t\tcase \"kerberosuseticketcache\", \"useticketcache\":\n\t\t\tenabled, err := strconv.ParseBool(value)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"invalid useticketcache option: %w\", err)\n\t\t\t}\n\t\t\tconfig.kerberos.useTicketCache = enabled\n\t\t\tconfig.kerberos.useTicketCacheSet = true\n\t\tcase \"compliancemode\":\n\t\t\t// JDBC compliance modes only alter java.sql behavior. The native DBX","sourceCodeStart":303,"sourceCodeEnd":339,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/cassandra-go/config.go#L303-L339","documentation":"The 'disablepafxfast' (or 'kerberosdisablepafxfast') URL parameter controls Kerberos PAFX fast negotiation and must parse as a boolean via strconv.ParseBool. Invalid values produce this wrapped error.","triggerScenarios":"DSN contains disablepafxfast=<value> or kerberosdisablepafxfast=<value> with a non-boolean string, e.g. disablepafxfast=off.","commonSituations":"Kerberos hardening guides using 'on'/'off' notation; misconfigured IaC templates emitting empty values; typos adding stray characters to the flag.","solutions":["Set the flag to true or false (strconv.ParseBool-accepted literals)","Remove the parameter to keep the default PAFX behavior","Verify templated values render a valid boolean before building the DSN"],"exampleFix":"// before\ncassandra://127.0.0.1/myks?disablepafxfast=off\n// after\ncassandra://127.0.0.1/myks?disablepafxfast=true","handlingStrategy":"validation","validationCode":"if v := q.Get(\"disablepafxfast\"); v != \"\" {\n\tif _, err := strconv.ParseBool(v); err != nil {\n\t\treturn errors.New(\"disablepafxfast must be a boolean\")\n\t}\n}","typeGuard":null,"tryCatchPattern":"if err := parseCassandraConfig(dsn); err != nil {\n\tif strings.Contains(err.Error(), \"disablepafxfast option\") {\n\t\treturn parseCassandraConfig(fixBoolParam(dsn, \"disablepafxfast\"))\n\t}\n\treturn err\n}","preventionTips":["Use true/false for kerberos boolean flags, never on/off","Validate generated Kerberos DSNs in CI","Avoid manual editing of long connection strings"],"tags":["config","url-params","kerberos","boolean-parsing","cassandra"],"backgroundTag":"invalid-url-parameter","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}