{"id":"8da138cc97d6c7fc","repo":"jackc/pgx","slug":"bad-auth-type-8da138","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_sasl.go","lineNumber":33,"sourceCode":"}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationSASL) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationSASL) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationSASL) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeSASL {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\tdst.AuthMechanisms = dst.AuthMechanisms[:0]\n\tauthMechanisms := src[4:]\n\tfor len(authMechanisms) > 1 {\n\t\tidx := bytes.IndexByte(authMechanisms, 0)\n\t\tif idx == -1 {\n\t\t\treturn &invalidMessageFormatErr{messageType: \"AuthenticationSASL\", details: \"unterminated string\"}\n\t\t}\n\t\tdst.AuthMechanisms = append(dst.AuthMechanisms, string(authMechanisms[:idx]))\n\t\tauthMechanisms = authMechanisms[idx+1:]\n\t}\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationSASL) Encode(dst []byte) ([]byte, error) {","sourceCodeStart":15,"sourceCodeEnd":51,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_sasl.go#L15-L51","documentation":"Returned by AuthenticationSASL.Decode in pgproto3/authentication_sasl.go:33 when the leading 4 bytes are not AuthTypeSASL (10). Redundant with frontend dispatch; firing means corruption after dispatch or Decode called on bytes whose code is not 10.","triggerScenarios":"Manual/proxy code decoding a non-SASL frame with the SASL struct; buffer mutation; fuzz input.","commonSituations":"Test/proxy hard-coding the wrong struct; corrupted reused buffer.","solutions":["Dispatch through findAuthenticationMessageType instead of a fixed struct.","Switch on the auth code (10 => SASL) when decoding manually.","Avoid reusing the byte buffer across messages."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASL {\n    var m pgproto3.AuthenticationSASL\n    return m.Decode(body)\n}","typeGuard":"func isSASLAuthFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASL\n}","tryCatchPattern":null,"preventionTips":["Dispatch through findAuthenticationMessageType instead of a fixed struct.","Switch on the auth code (10 => SASL) before Decode.","Avoid reusing the byte buffer across messages."],"tags":["authentication","protocol","sasl","scram","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}