{"id":"f6f3c54eff9c94a4","repo":"jackc/pgx","slug":"authentication-message-too-short-f6f3c5","errorCode":null,"errorMessage":"authentication message too short","messagePattern":"authentication message too short","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_sasl.go","lineNumber":27,"sourceCode":"\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\n// AuthenticationSASL is a message sent from the backend indicating that SASL authentication is required.\ntype AuthenticationSASL struct {\n\tAuthMechanisms []string\n}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationSASL) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationSASL) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationSASL) Decode(src []byte) error {\n\tif len(src) < 4 {\n\t\treturn errors.New(\"authentication message too short\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeSASL {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\tdst.AuthMechanisms = dst.AuthMechanisms[:0]\n\tauthMechanisms := src[4:]\n\tfor len(authMechanisms) > 1 {\n\t\tidx := bytes.IndexByte(authMechanisms, 0)\n\t\tif idx == -1 {\n\t\t\treturn &invalidMessageFormatErr{messageType: \"AuthenticationSASL\", details: \"unterminated string\"}\n\t\t}\n\t\tdst.AuthMechanisms = append(dst.AuthMechanisms, string(authMechanisms[:idx]))\n\t\tauthMechanisms = authMechanisms[idx+1:]\n\t}","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_sasl.go#L9-L45","documentation":"Returned by AuthenticationSASL.Decode in pgproto3/authentication_sasl.go:27 when the body is < 4 bytes. The SASL auth request lists supported mechanisms after the 4-byte auth code (AuthTypeSASL = 10), so the body must be at least 4 bytes. A shorter body means a truncated/corrupted frame or Decode on partial bytes.","triggerScenarios":"Server/intermediary sends a truncated SASL advertisement frame; stream cut during startup; non-PostgreSQL responder; direct Decode on undersized input in a SASL proxy/mock.","commonSituations":"SCRAM auth negotiation through a truncating proxy or unstable link; wrong-port service; fuzz input.","solutions":["Confirm the server is genuine PostgreSQL offering SASL/SCRAM.","Remove or reconfigure intermediaries that truncate the startup frame.","Require len(body) >= 4 before SASL Decode in custom code."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := pgconn.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"authentication message too short\") {\n        return fmt.Errorf(\"truncated SASL advertisement from %s: %w\", connString, err)\n    }\n    return err\n}","preventionTips":["Confirm the server is genuine PostgreSQL offering SASL/SCRAM.","Remove intermediaries that truncate the startup SASL frame.","Require len(body) >= 4 before AuthenticationSASL.Decode in custom code."],"tags":["authentication","protocol","sasl","scram","pgproto3"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}