{"id":"c8c0f9c56a9c1eb0","repo":"jackc/pgx","slug":"authentication-message-too-short-c8c0f9","errorCode":null,"errorMessage":"authentication message too short","messagePattern":"authentication message too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_sasl_final.go","lineNumber":26,"sourceCode":"\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\n// AuthenticationSASLFinal is a message sent from the backend indicating a SASL authentication has completed.\ntype AuthenticationSASLFinal struct {\n\tData []byte\n}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationSASLFinal) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationSASLFinal) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationSASLFinal) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeSASLFinal {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\tdst.Data = src[4:]\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationSASLFinal) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeSASLFinal)\n\tdst = append(dst, src.Data...)","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_sasl_final.go#L8-L44","documentation":"Returned by AuthenticationSASLFinal.Decode in pgproto3/authentication_sasl_final.go:26 when the body is < 4 bytes. SASLFinal carries the 4-byte auth code (AuthTypeSASLFinal = 12) followed by the variable server-final SCRAM message, so anything shorter than 4 bytes cannot be type-checked. Indicates truncation/corruption or Decode on partial bytes.","triggerScenarios":"The server-final SCRAM frame arrives truncated at the end of the SCRAM exchange; connection dropped just before auth completes; proxy truncates the frame; direct Decode on undersized input.","commonSituations":"SCRAM-SHA-256 over an unstable link or truncating proxy; fuzz input.","solutions":["Keep the connection stable through the final SCRAM step.","Remove intermediaries that truncate the server-final message.","Validate len(body) >= 4 before decoding in custom code."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := pgconn.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication message too short\") {\n        return fmt.Errorf(\"truncated SASL final frame from %s: %w\", connString, err)\n    }\n    return err\n}","preventionTips":["Keep the connection stable through the final SCRAM step.","Remove intermediaries that truncate the server-final SCRAM message.","Validate len(body) >= 4 before AuthenticationSASLFinal.Decode in custom code."],"tags":["authentication","protocol","sasl","scram","pgproto3"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}