{"id":"59d2894519861427","repo":"jackc/pgx","slug":"bad-auth-type-59d289","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_sasl_continue.go","lineNumber":32,"sourceCode":"}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationSASLContinue) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationSASLContinue) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationSASLContinue) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeSASLContinue {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\tdst.Data = src[4:]\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationSASLContinue) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeSASLContinue)\n\tdst = append(dst, src.Data...)\n\treturn finishMessage(dst, sp)\n}\n\n// MarshalJSON implements encoding/json.Marshaler.\nfunc (src AuthenticationSASLContinue) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_sasl_continue.go#L14-L50","documentation":"Returned by AuthenticationSASLContinue.Decode in pgproto3/authentication_sasl_continue.go:32 when the leading 4 bytes are not AuthTypeSASLContinue (11). Defensive check redundant with frontend dispatch; firing means corruption after dispatch or Decode called on bytes whose code is not 11.","triggerScenarios":"Manual/proxy code decoding a non-SASLContinue frame with the SASLContinue struct; buffer mutation; fuzz input.","commonSituations":"Test/proxy hard-coding the wrong struct; corrupted reused buffer.","solutions":["Dispatch via findAuthenticationMessageType rather than a fixed struct.","Switch on the auth code (11 => SASLContinue) when decoding manually.","Do not alias/reuse the message buffer across decodes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASLContinue {\n    var m pgproto3.AuthenticationSASLContinue\n    return m.Decode(body)\n}","typeGuard":"func isSASLContinueFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASLContinue\n}","tryCatchPattern":null,"preventionTips":["Dispatch via findAuthenticationMessageType rather than a fixed struct.","Switch on the auth code (11 => SASLContinue) before Decode.","Do not alias/reuse the message buffer across decodes."],"tags":["authentication","protocol","sasl","scram","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}