{"id":"6b968bb9486cb56c","repo":"jackc/pgx","slug":"bad-auth-type-6b968b","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_ok.go","lineNumber":30,"sourceCode":"type AuthenticationOk struct{}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationOk) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationOk) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationOk) Decode(src []byte) error {\n\tif len(src) != 4 {\n\t\treturn errors.New(\"bad authentication message size\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeOk {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationOk) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeOk)\n\treturn finishMessage(dst, sp)\n}\n\n// MarshalJSON implements encoding/json.Marshaler.\nfunc (src AuthenticationOk) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {\n\t\tType string\n\t}{\n\t\tType: \"AuthenticationOK\",","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_ok.go#L12-L48","documentation":"Returned by AuthenticationOk.Decode in pgproto3/authentication_ok.go:30 when the leading 4 bytes are not AuthTypeOk (0). Defensive check redundant with frontend dispatch; firing means corruption after dispatch or Decode called on bytes whose code is not 0.","triggerScenarios":"Manual/proxy code decoding a non-Ok frame with the AuthenticationOk struct; buffer mutation; fuzz input.","commonSituations":"Test/proxy hard-coding the wrong struct; corrupted reused buffer.","solutions":["Use findAuthenticationMessageType for dispatch instead of a fixed struct.","Switch on the auth code (0 => Ok) when decoding manually.","Do not alias the message buffer across decodes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeOk {\n    var m pgproto3.AuthenticationOk\n    return m.Decode(body)\n}","typeGuard":"func isAuthOkFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeOk\n}","tryCatchPattern":null,"preventionTips":["Use findAuthenticationMessageType for dispatch instead of a fixed struct.","Switch on the auth code (0 => Ok) before Decode.","Do not alias the message buffer across decodes."],"tags":["authentication","protocol","auth-ok","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}