{"id":"8b831446e3aa3411","repo":"jackc/pgx","slug":"invalid-scram-nonce-did-not-start-with-client-non","errorCode":null,"errorMessage":"invalid SCRAM nonce: did not start with client nonce","messagePattern":"invalid SCRAM nonce: did not start with client nonce","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"pgconn/auth_scram.go","lineNumber":296,"sourceCode":"\tsc.salt, err = base64.StdEncoding.DecodeString(string(saltStr))\n\tif err != nil {\n\t\treturn fmt.Errorf(\"invalid SCRAM salt received from server: %w\", err)\n\t}\n\n\tsc.iterations, err = strconv.Atoi(string(iterationsStr))\n\tif err != nil || sc.iterations <= 0 {\n\t\treturn fmt.Errorf(\"invalid SCRAM iteration count received from server: %w\", err)\n\t}\n\t// Bound server-supplied iteration count to prevent a malicious server from forcing the client\n\t// to spend unbounded CPU in PBKDF2. PostgreSQL's scram_iterations defaults to 4096; this ceiling\n\t// is ~2500x that.\n\tconst maxScramIterations = 10_000_000\n\tif sc.iterations > maxScramIterations {\n\t\treturn fmt.Errorf(\"SCRAM iteration count from server too high: %d (max %d)\", sc.iterations, maxScramIterations)\n\t}\n\n\tif !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not start with client nonce\")\n\t}\n\n\tif len(sc.clientAndServerNonce) <= len(sc.clientNonce) {\n\t\treturn errors.New(\"invalid SCRAM nonce: did not include server nonce\")\n\t}\n\n\treturn nil\n}\n\nfunc (sc *scramClient) clientFinalMessage() string {\n\t// The c= attribute carries the base64-encoded channel binding input.\n\t//\n\t// Without channel binding this is just the GS2 header alone (\"biws\" for\n\t// \"n,,\" or \"eSws\" for \"y,,\").\n\t//\n\t// With channel binding, this is the GS2 header with the channel binding data\n\t// (certificate hash) appended.\n\tchannelBindInput := sc.clientGS2Header","sourceCodeStart":278,"sourceCodeEnd":314,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgconn/auth_scram.go#L278-L314","documentation":"Returned by recvServerFirstMessage when the combined nonce (r=) from the server does not start with the client's own nonce. Per RFC 5802 the server must concatenate the client nonce with its own nonce, so a prefix mismatch signals a broken or malicious server that did not echo the client nonce.","triggerScenarios":"Server returns an r= value whose prefix differs from the clientNonce generated by newScramClient. Classic indicator of a rogue server/MITM that fabricated its own nonce instead of extending the client's.","commonSituations":"Man-in-the-middle attempting a SCRAM downgrade/relay; buggy server generating a fresh nonce; protocol corruption.","solutions":["Treat this as a potential security incident: verify the server identity and network path (use TLS + verify-full).","Ensure no intermediary is terminating/reoriginating the SASL handshake.","Confirm the server is genuine PostgreSQL; capture the handshake if it recurs."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// A nonce prefix mismatch is a strong MITM signal; do NOT silently retry.\nif err := connect(); err != nil && strings.Contains(err.Error(), \"did not start with client nonce\") {\n    securityLog.Error(\"possible SCRAM MITM detected: server nonce prefix mismatch\", \"err\", err)\n    return errors.Join(err, errPossibleMITM)\n}","preventionTips":["Always use sslmode=verify-full with a trusted root cert to authenticate the server.","Investigate nonce mismatches as security incidents.","Remove any intermediary that reoriginates SASL handshakes."],"tags":["authentication","scram","security","mitm","protocol"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}