{"id":"eb1808c59654ab07","repo":"jackc/pgx","slug":"authentication-message-too-short-eb1808","errorCode":null,"errorMessage":"authentication message too short","messagePattern":"authentication message too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_gss_continue.go","lineNumber":21,"sourceCode":"import (\n\t\"encoding/binary\"\n\t\"encoding/json\"\n\t\"errors\"\n\n\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\ntype AuthenticationGSSContinue struct {\n\tData []byte\n}\n\nfunc (a *AuthenticationGSSContinue) Backend() {}\n\nfunc (a *AuthenticationGSSContinue) AuthenticationResponse() {}\n\nfunc (a *AuthenticationGSSContinue) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeGSSCont {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\ta.Data = src[4:]\n\treturn nil\n}\n\nfunc (a *AuthenticationGSSContinue) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeGSSCont)\n\tdst = append(dst, a.Data...)\n\treturn finishMessage(dst, sp)\n}","sourceCodeStart":3,"sourceCodeEnd":39,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_gss_continue.go#L3-L39","documentation":"Returned by AuthenticationGSSContinue.Decode in pgproto3/authentication_gss_continue.go:21 when the body is < 4 bytes. GSSContinue carries the 4-byte auth code (AuthTypeGSSCont = 8) followed by a variable GSS data payload, so anything shorter than 4 bytes cannot even be type-checked. Indicates truncation/corruption or Decode on partial bytes.","triggerScenarios":"A GSS continue frame arrives truncated during the multi-round-trip Kerberos exchange; connection dropped mid-handshake; proxy truncates the frame; direct Decode on undersized input.","commonSituations":"GSS/Kerberos auth over an unstable link or through a truncating proxy; large GSS tokens split incorrectly; fuzz input.","solutions":["Ensure the connection stays open for the full multi-step GSS exchange.","Remove intermediaries that truncate large GSS continuation tokens.","Validate len(body) >= 4 before decoding in custom code."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := pgconn.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication message too short\") {\n        return fmt.Errorf(\"truncated GSS continue frame from %s: %w\", connString, err)\n    }\n    return err\n}","preventionTips":["Keep the connection open across the full multi-step GSS exchange.","Remove intermediaries that truncate large GSS continuation tokens.","Require len(body) >= 4 before AuthenticationGSSContinue.Decode in custom code."],"tags":["authentication","protocol","gss","kerberos","pgproto3"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}