jackc/pgx · error

authentication message too short

Error message

authentication message too short

What it means

Returned by AuthenticationSASL.Decode in pgproto3/authentication_sasl.go:27 when the body is < 4 bytes. The SASL auth request lists supported mechanisms after the 4-byte auth code (AuthTypeSASL = 10), so the body must be at least 4 bytes. A shorter body means a truncated/corrupted frame or Decode on partial bytes.

Source

Thrown at pgproto3/authentication_sasl.go:27

	"github.com/jackc/pgx/v5/internal/pgio"
)

// AuthenticationSASL is a message sent from the backend indicating that SASL authentication is required.
type AuthenticationSASL struct {
	AuthMechanisms []string
}

// Backend identifies this message as sendable by the PostgreSQL backend.
func (*AuthenticationSASL) Backend() {}

// Backend identifies this message as an authentication response.
func (*AuthenticationSASL) AuthenticationResponse() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *AuthenticationSASL) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeSASL {
		return errors.New("bad auth type")
	}

	dst.AuthMechanisms = dst.AuthMechanisms[:0]
	authMechanisms := src[4:]
	for len(authMechanisms) > 1 {
		idx := bytes.IndexByte(authMechanisms, 0)
		if idx == -1 {
			return &invalidMessageFormatErr{messageType: "AuthenticationSASL", details: "unterminated string"}
		}
		dst.AuthMechanisms = append(dst.AuthMechanisms, string(authMechanisms[:idx]))
		authMechanisms = authMechanisms[idx+1:]
	}

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Confirm the server is genuine PostgreSQL offering SASL/SCRAM.
2. Remove or reconfigure intermediaries that truncate the startup frame.
3. Require len(body) >= 4 before SASL Decode in custom code.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "authentication message too short") {
        return fmt.Errorf("truncated SASL advertisement from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: Server/intermediary sends a truncated SASL advertisement frame; stream cut during startup; non-PostgreSQL responder; direct Decode on undersized input in a SASL proxy/mock.

Common situations: SCRAM auth negotiation through a truncating proxy or unstable link; wrong-port service; fuzz input.

Related errors

• bad auth type
• authentication message too short
• bad auth type
• authentication message too short
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/f6f3c54eff9c94a4.json. Report an issue: GitHub.