{"id":"d6c6aae7b3bd2fc7","repo":"jackc/pgx","slug":"bad-auth-type-d6c6aa","errorCode":null,"errorMessage":"bad auth type","messagePattern":"bad auth type","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_gss.go","lineNumber":25,"sourceCode":"\n\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\ntype AuthenticationGSS struct{}\n\nfunc (a *AuthenticationGSS) Backend() {}\n\nfunc (a *AuthenticationGSS) AuthenticationResponse() {}\n\nfunc (a *AuthenticationGSS) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeGSS {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\treturn nil\n}\n\nfunc (a *AuthenticationGSS) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeGSS)\n\treturn finishMessage(dst, sp)\n}\n\nfunc (a *AuthenticationGSS) MarshalJSON() ([]byte, error) {\n\treturn json.Marshal(struct {\n\t\tType string\n\t\tData []byte\n\t}{\n\t\tType: \"AuthenticationGSS\",\n\t})\n}","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_gss.go#L7-L43","documentation":"Returned by AuthenticationGSS.Decode in pgproto3/authentication_gss.go:25 when the leading 4 bytes are not AuthTypeGSS (7). Redundant with the frontend's dispatch; firing means corruption after dispatch or Decode invoked manually on a frame whose code is not 7 (e.g. SASL or GSSContinue bytes fed to the GSS struct).","triggerScenarios":"Manual/proxy code decoding a non-GSS frame with the GSS struct; buffer mutation; fuzz input.","commonSituations":"Custom GSS proxy or test that hard-codes the wrong struct; corrupted buffer reused across decode calls.","solutions":["Use findAuthenticationMessageType / Frontend.Receive for dispatch instead of a fixed struct.","When decoding manually, switch on the 4-byte auth code (7 => GSS, 8 => GSSContinue).","Avoid reusing the underlying byte buffer across messages."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSS {\n    var m pgproto3.AuthenticationGSS\n    return m.Decode(body)\n}","typeGuard":"func isGSSAuthFrame(body []byte) bool {\n    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSS\n}","tryCatchPattern":null,"preventionTips":["Dispatch via findAuthenticationMessageType, not a fixed struct.","Switch on the auth code (7 => GSS) before Decode.","Do not alias the message buffer across decodes."],"tags":["authentication","protocol","gss","kerberos","pgproto3","validation"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}