{"id":"97c6f77818857601","repo":"jackc/pgx","slug":"authentication-message-too-short-97c6f7","errorCode":null,"errorMessage":"authentication message too short","messagePattern":"authentication message too short","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/frontend.go","lineNumber":427,"sourceCode":"// Authentication message type constants.\n// See src/include/libpq/pqcomm.h for all\n// constants.\nconst (\n\tAuthTypeOk                = 0\n\tAuthTypeCleartextPassword = 3\n\tAuthTypeMD5Password       = 5\n\tAuthTypeSCMCreds          = 6\n\tAuthTypeGSS               = 7\n\tAuthTypeGSSCont           = 8\n\tAuthTypeSSPI              = 9\n\tAuthTypeSASL              = 10\n\tAuthTypeSASLContinue      = 11\n\tAuthTypeSASLFinal         = 12\n)\n\nfunc (f *Frontend) findAuthenticationMessageType(src []byte) (BackendMessage, error) {\n\tif len(src) < 4 {\n\t\treturn nil, errors.New(\"authentication message too short\")\n\t}\n\tf.authType = binary.BigEndian.Uint32(src[:4])\n\n\tswitch f.authType {\n\tcase AuthTypeOk:\n\t\treturn &f.authenticationOk, nil\n\tcase AuthTypeCleartextPassword:\n\t\treturn &f.authenticationCleartextPassword, nil\n\tcase AuthTypeMD5Password:\n\t\treturn &f.authenticationMD5Password, nil\n\tcase AuthTypeSCMCreds:\n\t\treturn nil, errors.New(\"AuthTypeSCMCreds is unimplemented\")\n\tcase AuthTypeGSS:\n\t\treturn &f.authenticationGSS, nil\n\tcase AuthTypeGSSCont:\n\t\treturn &f.authenticationGSSContinue, nil\n\tcase AuthTypeSSPI:\n\t\treturn nil, errors.New(\"AuthTypeSSPI is unimplemented\")","sourceCodeStart":409,"sourceCodeEnd":445,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/frontend.go#L409-L445","documentation":"Returned by Frontend.findAuthenticationMessageType when the 'R' (Authentication) message body is shorter than 4 bytes. The first 4 bytes of an authentication message carry the auth-type code that selects the concrete sub-message, so fewer than 4 bytes cannot even be dispatched. This indicates a truncated or corrupt message from the server.","triggerScenarios":"Frontend.Receive reads an 'R'-typed message whose declared body length is less than 4 bytes, then findAuthenticationMessageType rejects it. Hit during the connection authentication handshake when the server (or a proxy in between) sends a malformed Authentication message.","commonSituations":"A buggy proxy or a man-in-the-middle truncates the auth message. A non-PostgreSQL server (or a port pointed at the wrong service) returns bytes that happen to parse as an 'R' type but with no payload. Connection corruption or a half-closed socket can also produce this.","solutions":["Verify you are connecting to a real PostgreSQL server on the correct host/port (check for a mispointed service or a load balancer returning an HTTP error page).","If a proxy is in the path, ensure it forwards Authentication messages without truncation.","Log the full message length and type byte to confirm the framing is correct; a length < 4 on an 'R' message is almost always upstream corruption.","Reconnect; transient corruption may clear. If it persists, capture a packet trace to locate where bytes are dropped."],"exampleFix":"// before\ncfg, _ := pgx.ParseConfig(\"host=db port=5432\")\nconn, err := pgx.ConnectConfig(ctx, cfg) // server/proxy sent a truncated 'R' message\n\n// after\ncfg, _ := pgx.ParseConfig(\"host=db port=5432\")\ncfg.Tracer = tracelog.NewLoggerTracer(logger) // surface the exact message that fails\nconn, err := pgx.ConnectConfig(ctx, cfg)\nif err != nil {\n    log.Printf(\"auth handshake failed (is %s:%d really postgres?): %v\", cfg.Host, cfg.Port, err)\n}","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"conn, err := pgx.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication message too short\") {\n        // server/proxy sent a truncated 'R' message — likely wrong endpoint or corrupted stream\n        log.Printf(\"auth handshake corrupt: %v. Verify %s is a real PostgreSQL server.\", err, connString)\n    }\n    return err\n}","preventionTips":["Confirm the host:port points at a real PostgreSQL server, not an HTTP service or load balancer.","If a proxy sits in the path, verify it forwards Authentication messages intact.","Enable a tracer (tracelog) to capture the exact message bytes that fail.","Capture a packet trace when the error persists to locate where bytes are dropped."],"tags":["pgproto3","protocol","decoding","authentication","wire-protocol","connection"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}