jackc/pgx · error

bad auth type

Error message

bad auth type

What it means

Returned by AuthenticationSASLContinue.Decode in pgproto3/authentication_sasl_continue.go:32 when the leading 4 bytes are not AuthTypeSASLContinue (11). Defensive check redundant with frontend dispatch; firing means corruption after dispatch or Decode called on bytes whose code is not 11.

Source

Thrown at pgproto3/authentication_sasl_continue.go:32

}

// Backend identifies this message as sendable by the PostgreSQL backend.
func (*AuthenticationSASLContinue) Backend() {}

// Backend identifies this message as an authentication response.
func (*AuthenticationSASLContinue) AuthenticationResponse() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *AuthenticationSASLContinue) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeSASLContinue {
		return errors.New("bad auth type")
	}

	dst.Data = src[4:]

	return nil
}

// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
func (src *AuthenticationSASLContinue) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeSASLContinue)
	dst = append(dst, src.Data...)
	return finishMessage(dst, sp)
}

// MarshalJSON implements encoding/json.Marshaler.
func (src AuthenticationSASLContinue) MarshalJSON() ([]byte, error) {
	return json.Marshal(struct {

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Dispatch via findAuthenticationMessageType rather than a fixed struct.
2. Switch on the auth code (11 => SASLContinue) when decoding manually.
3. Do not alias/reuse the message buffer across decodes.

if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASLContinue {
    var m pgproto3.AuthenticationSASLContinue
    return m.Decode(body)
}

func isSASLContinueFrame(body []byte) bool {
    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeSASLContinue
}

When it happens

Trigger: Manual/proxy code decoding a non-SASLContinue frame with the SASLContinue struct; buffer mutation; fuzz input.

Common situations: Test/proxy hard-coding the wrong struct; corrupted reused buffer.

Related errors

• bad auth type
• bad auth type
• authentication message too short
• authentication message too short
• authentication message too short

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/59d2894519861427.json. Report an issue: GitHub.