{"record":{"id":"ee183f366a3a7050","repo":"cube-js/cube","slug":"incorrect-payload-size-in-sasl-message-payloads","errorCode":null,"errorMessage":"Incorrect payload size in SASL message: ${payloadSize}","messagePattern":"Incorrect payload size in SASL message: (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/cubejs-hive-driver/src/TSaslTransport.js","lineNumber":126,"sourceCode":"      };\n    }\n\n    static sendSaslMessage(status, payload, callback) {\n      const saslTransport = new thrift.TBufferedTransport(null, callback);\n      const messageHeader = Buffer.alloc(5);\n      messageHeader.writeInt8(status);\n      messageHeader.writeUInt32BE(payload.length, 1);\n      saslTransport.write(messageHeader);\n      saslTransport.write(payload);\n      saslTransport.flush();\n    }\n\n    static receiveSaslMessage(transport) {\n      const buffer = transport.read(5);\n      const status = buffer.readInt8();\n      const payloadSize = buffer.readUInt32BE(1);\n      if (payloadSize < 0 || payloadSize > 104857600) {\n        throw new Error(`Incorrect payload size in SASL message: ${payloadSize}`);\n      }\n      const payload = transport.read(payloadSize);\n      if (status === BAD || status === ERROR) {\n        throw new Error(`SASL Error: ${payload.toString('utf-8')}`);\n      }\n      return { status, payload };\n    }\n  }\n\n  return TSaslTransport;\n};\n","sourceCodeStart":108,"sourceCodeEnd":138,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-hive-driver/src/TSaslTransport.js#L108-L138","documentation":"TSaslTransport.receiveSaslMessage reads the 5-byte SASL frame header (1-byte status + 4-byte big-endian payload size) from the thrift transport. If the declared payload size is larger than the 100MB safety limit (104857600 bytes), the driver refuses to allocate/read it and throws this error. It is a guard against corrupt or malicious framing from the server (or a non-SASL server being spoken to with SASL framing).","triggerScenarios":"Server (or proxy) sends a SASL-framed response whose 4-byte length prefix exceeds 104857600 bytes; typically happens when the underlying bytes are not actually SASL-framed (misaligned stream) or a huge payload is returned.","commonSituations":"Connecting to a Hive/Impala endpoint that does not use SASL (no plain auth / wrong transport type); a proxy or load balancer corrupting the thrift stream; garbage bytes after a handshake desynchronizing the frame reader.","solutions":["Verify the server actually uses SASL (QOP/authentication) framing and that the driver is instantiated with matching transport/thrift options","Check for a proxy/firewall/middlebox mangling the connection; connect directly to test","Restart or re-establish the connection to resync the byte stream; if persistent, inspect server logs for oversized messages","As a last resort confirm no legitimate response >100MB is expected; otherwise the framing is corrupt, not a real size issue"],"exampleFix":"// before: driver configured for SASL against a non-SASL server\nnew HiveDriver({ url: 'http://non-sasl-host:10000', ... });\n// after: align transport with server (non-SASL http mode, or enable SASL on server)\nnew HiveDriver({ url: 'http://host:10000', transport: 'http' });","handlingStrategy":"validation","validationCode":"// Probe the server transport before connecting:\nconst net = require('net');\nconst s = net.connect(port, host, () => s.end());\ns.on('error', () => console.warn('Cannot reach Hive host; SASL framing check skipped'));\n// Ensure driver transport matches server: server-side hive.server2.authentication must align with driver options","typeGuard":"function isPlausibleSaslFrame(buf) {\n  if (!Buffer.isBuffer(buf) || buf.length < 5) return false;\n  const payloadSize = buf.readUInt32BE(1);\n  return payloadSize >= 0 && payloadSize <= 104857600;\n}","tryCatchPattern":"try {\n  await driver.query(...);\n} catch (e) {\n  if (String(e.message).startsWith('Incorrect payload size in SASL message')) {\n    // reconnect / fall back to non-SASL transport or surface a config hint\n  } else throw e;\n}","preventionTips":["Match driver transport/auth options to the server's hive.server2.authentication setting","Avoid proxies/middleboxes on the thrift connection, or verify they pass bytes verbatim","Keep the SASL payload under the 100MB limit; check server logs for oversized responses","On persistent size errors, restart the connection — the stream is likely desynchronized"],"tags":["sasl","thrift","network","hive"],"backgroundTag":"sasl-frame-corruption","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}