jackc/pgx · error

authentication message too short

Error message

authentication message too short

What it means

Returned by AuthenticationSASLContinue.Decode in pgproto3/authentication_sasl_continue.go:26 when the body is < 4 bytes. SASLContinue carries the 4-byte auth code (AuthTypeSASLContinue = 11) followed by a variable SCRAM challenge payload, so anything shorter than 4 bytes cannot be type-checked. Indicates truncation/corruption or Decode on partial bytes.

Source

Thrown at pgproto3/authentication_sasl_continue.go:26

	"github.com/jackc/pgx/v5/internal/pgio"
)

// AuthenticationSASLContinue is a message sent from the backend containing a SASL challenge.
type AuthenticationSASLContinue struct {
	Data []byte
}

// Backend identifies this message as sendable by the PostgreSQL backend.
func (*AuthenticationSASLContinue) Backend() {}

// Backend identifies this message as an authentication response.
func (*AuthenticationSASLContinue) AuthenticationResponse() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *AuthenticationSASLContinue) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeSASLContinue {
		return errors.New("bad auth type")
	}

	dst.Data = src[4:]

	return nil
}

// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
func (src *AuthenticationSASLContinue) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeSASLContinue)
	dst = append(dst, src.Data...)

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Keep the connection alive through the full multi-step SCRAM exchange.
2. Remove intermediaries that truncate SCRAM challenge payloads.
3. Validate len(body) >= 4 before decoding in custom code.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "authentication message too short") {
        return fmt.Errorf("truncated SASL continue frame from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: A SASL continue (SCRAM challenge) frame arrives truncated mid-SCRAM exchange; connection dropped during auth; proxy truncates the frame; direct Decode on undersized input.

Common situations: SCRAM-SHA-256 over an unstable link or truncating proxy; large challenge split incorrectly; fuzz input.

Related errors

• authentication message too short
• bad auth type
• bad auth type
• authentication message too short
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/d87a3f8a496e4a6a.json. Report an issue: GitHub.