{"id":"023329622956843e","repo":"jackc/pgx","slug":"invalid-scram-nonce-did-not-include-server-nonce","errorCode":null,"errorMessage":"invalid SCRAM nonce: did not include server nonce","messagePattern":"invalid SCRAM nonce: did not include server nonce","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":300,"sourceCode":"\n\tsc.iterations, err = strconv.Atoi(string(iterationsStr))\n\tif err != nil || sc.iterations <= 0 {\n\t\treturn fmt.Errorf(\"invalid SCRAM iteration count received from server: %w\", err)\n\t}\n\t// Bound server-supplied iteration count to prevent a malicious server from forcing the client\n\t// to spend unbounded CPU in PBKDF2. PostgreSQL's scram_iterations defaults to 4096; this ceiling\n\t// is ~2500x that.\n\tconst maxScramIterations = 10_000_000\n\tif sc.iterations > maxScramIterations {\n\t\treturn fmt.Errorf(\"SCRAM iteration count from server too high: %d (max %d)\", sc.iterations, maxScramIterations)\n\t}\n\n\tif !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not start with client nonce\")\n\t}\n\n\tif len(sc.clientAndServerNonce) <= len(sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not include server nonce\")\n\t}\n\n\treturn nil\n}\n\nfunc (sc *scramClient) clientFinalMessage() string {\n\t// The c= attribute carries the base64-encoded channel binding input.\n\t//\n\t// Without channel binding this is just the GS2 header alone (\"biws\" for\n\t// \"n,,\" or \"eSws\" for \"y,,\").\n\t//\n\t// With channel binding, this is the GS2 header with the channel binding data\n\t// (certificate hash) appended.\n\tchannelBindInput := sc.clientGS2Header\n\tif sc.authMechanism == scramSHA256PlusName {\n\t\tchannelBindInput = slices.Concat(sc.clientGS2Header, sc.channelBindingData)\n\t}\n\tchannelBindingEncoded := base64.StdEncoding.EncodeToString(channelBindInput)","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L282-L318","documentation":"Returned by recvServerFirstMessage when the combined nonce (r=) starts with the client nonce but is not longer than it, meaning the server appended no nonce of its own. RFC 5802 requires the server to contribute its own nonce; absence indicates a non-conformant or rogue server.","triggerScenarios":"Server echoes exactly the client nonce (r=<clientNonce>) without appending a server portion. Detected by the length check len(clientAndServerNonce) <= len(clientNonce).","commonSituations":"Buggy server/proxy that parrots the client nonce; rogue endpoint; corrupted exchange.","solutions":["Verify the backend is a conformant PostgreSQL SCRAM implementation that generates a server nonce.","Rule out MITM/proxy reorigination of the SASL message.","Capture the handshake and report the non-conformance."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := connect(); err != nil && strings.Contains(err.Error(), \"did not include server nonce\") {\n    return fmt.Errorf(\"server failed to contribute a SCRAM nonce (non-conformant/MITM): %w\", err)\n}","preventionTips":["Ensure a conformant PostgreSQL backend that appends its own nonce.","Use TLS certificate verification end-to-end.","Capture the handshake to confirm the server is the source."],"tags":["authentication","scram","security","protocol"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}