{"id":"f88e9b3ea0a57edd","repo":"jackc/pgx","slug":"bad-authentication-message-size-f88e9b","errorCode":null,"errorMessage":"bad authentication message size","messagePattern":"bad authentication message size","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pgproto3/authentication_ok.go","lineNumber":24,"sourceCode":"\t\"errors\"\n\n\t\"github.com/jackc/pgx/v5/internal/pgio\"\n)\n\n// AuthenticationOk is a message sent from the backend indicating that authentication was successful.\ntype AuthenticationOk struct{}\n\n// Backend identifies this message as sendable by the PostgreSQL backend.\nfunc (*AuthenticationOk) Backend() {}\n\n// Backend identifies this message as an authentication response.\nfunc (*AuthenticationOk) AuthenticationResponse() {}\n\n// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message\n// type identifier and 4 byte message length.\nfunc (dst *AuthenticationOk) Decode(src []byte) error {\n\tif len(src) != 4 {\n\t\treturn errors.New(\"bad authentication message size\")\n\t}\n\n\tauthType := binary.BigEndian.Uint32(src)\n\n\tif authType != AuthTypeOk {\n\t\treturn errors.New(\"bad auth type\")\n\t}\n\n\treturn nil\n}\n\n// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.\nfunc (src *AuthenticationOk) Encode(dst []byte) ([]byte, error) {\n\tdst, sp := beginMessage(dst, 'R')\n\tdst = pgio.AppendUint32(dst, AuthTypeOk)\n\treturn finishMessage(dst, sp)\n}\n","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/jackc/pgx/blob/ec1a0befd22592cffffdeeb0a50311b506372f4c/pgproto3/authentication_ok.go#L6-L42","documentation":"Returned by AuthenticationOk.Decode in pgproto3/authentication_ok.go:24 when the 'R' message body is not exactly 4 bytes. AuthenticationOk carries only the 4-byte auth code (AuthTypeOk = 0) signalling successful auth, so any other length is a protocol violation.","triggerScenarios":"Server/intermediary sends an AuthenticationOk frame whose body is not 4 bytes; truncated/garbled stream; non-PostgreSQL responder; direct Decode on malformed bytes. This is the terminal 'auth succeeded' message, so corruption here usually means the whole handshake is bogus.","commonSituations":"Wrong-port service impersonating Postgres; proxy corrupting the final auth frame; packet corruption; fuzz input.","solutions":["Verify the endpoint is a genuine PostgreSQL server.","Bypass intermediaries and retry the connection.","Validate len(body) == 4 before Decode in custom pgproto3 code."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"conn, err := pgconn.Connect(ctx, connString)\nif err != nil {\n    if strings.Contains(err.Error(), \"bad authentication message size\") {\n        return fmt.Errorf(\"malformed AuthenticationOk frame from %s: %w\", connString, err)\n    }\n    return err\n}","preventionTips":["Confirm the endpoint is genuine PostgreSQL (the auth-ok frame is the handshake finale).","Bypass intermediaries and retry to rule out corruption of the final auth frame.","Assert len(body)==4 before AuthenticationOk.Decode in custom pgproto3 code."],"tags":["authentication","protocol","auth-ok","pgproto3","connection"],"analyzedSha":"ec1a0befd22592cffffdeeb0a50311b506372f4c","analyzedAt":"2026-08-04T22:52:11.263Z","schemaVersion":2}