{"id":"6368225f2da67f05","repo":"jackc/pgx","slug":"invalid-scram-salt-received-from-server-w","errorCode":null,"errorMessage":"invalid SCRAM salt received from server: %w","messagePattern":"invalid SCRAM salt received from server: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgconn/auth_scram.go","lineNumber":280,"sourceCode":"\tbuf = buf[2:]\n\n\tidx = bytes.IndexByte(buf, ',')\n\tif idx == -1 {\n\t\treturn errors.New(\"invalid SCRAM server-first-message received from server: did not include i=\")\n\t}\n\tsaltStr := buf[:idx]\n\tbuf = buf[idx+1:]\n\n\tif !bytes.HasPrefix(buf, []byte(\"i=\")) {\n\t\treturn errors.New(\"invalid SCRAM server-first-message received from server: did not include i=\")\n\t}\n\tbuf = buf[2:]\n\titerationsStr := buf\n\n\tvar err error\n\tsc.salt, err = base64.StdEncoding.DecodeString(string(saltStr))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid SCRAM salt received from server: %w\", err)\n\t}\n\n\tsc.iterations, err = strconv.Atoi(string(iterationsStr))\n\tif err != nil || sc.iterations <= 0 {\n\t\treturn fmt.Errorf(\"invalid SCRAM iteration count received from server: %w\", err)\n\t}\n\t// Bound server-supplied iteration count to prevent a malicious server from forcing the client\n\t// to spend unbounded CPU in PBKDF2. PostgreSQL's scram_iterations defaults to 4096; this ceiling\n\t// is ~2500x that.\n\tconst maxScramIterations = 10_000_000\n\tif sc.iterations > maxScramIterations {\n\t\treturn fmt.Errorf(\"SCRAM iteration count from server too high: %d (max %d)\", sc.iterations, maxScramIterations)\n\t}\n\n\tif !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not start with client nonce\")\n\t}\n","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L262-L298","documentation":"Error \"invalid SCRAM salt received from server: %w\" thrown in jackc/pgx.","triggerScenarios":"Thrown at pgconn/auth_scram.go:280 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}