{"id":"b7e48d7854f535b3","repo":"jackc/pgx","slug":"bad-auth-type-b7e48d","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_gss_continue.go","lineNumber":27,"sourceCode":")\n\ntype AuthenticationGSSContinue struct {\n\tData []byte\n}\n\nfunc (a *AuthenticationGSSContinue) Backend() {}\n\nfunc (a *AuthenticationGSSContinue) AuthenticationResponse() {}\n\nfunc (a *AuthenticationGSSContinue) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeGSSCont {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\ta.Data = src[4:]\n\treturn nil\n}\n\nfunc (a *AuthenticationGSSContinue) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeGSSCont)\n\tdst = append(dst, a.Data...)\n\treturn finishMessage(dst, sp)\n}\n\nfunc (a *AuthenticationGSSContinue) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {\n\t\tType string\n\t\tData []byte\n\t}{","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_gss_continue.go#L9-L45","documentation":"Returned by AuthenticationGSSContinue.Decode in pgproto3/authentication_gss_continue.go:27 when the leading 4 bytes are not AuthTypeGSSCont (8). Defensive check redundant with frontend dispatch; firing means corruption or Decode called on bytes whose code is not 8.","triggerScenarios":"Manual/proxy code decoding a non-GSSContinue frame with the GSSContinue struct; buffer mutation; fuzz input.","commonSituations":"Custom GSS proxy/test hard-coding the wrong struct; corrupted reused buffer.","solutions":["Dispatch via findAuthenticationMessageType rather than a fixed struct.","Switch on the auth code (8 => GSSContinue) when decoding manually.","Do not alias/reuse the message buffer across decodes."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSSCont {\n    var m pgproto3.AuthenticationGSSContinue\n    return m.Decode(body)\n}","typeGuard":"func isGSSContinueFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSSCont\n}","tryCatchPattern":null,"preventionTips":["Dispatch via findAuthenticationMessageType rather than a fixed struct.","Switch on the auth code (8 => GSSContinue) before Decode.","Avoid reusing the byte buffer across messages."],"tags":["authentication","protocol","gss","kerberos","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}