jackc/pgx · error

bad auth type

Error message

bad auth type

What it means

Returned by AuthenticationGSSContinue.Decode in pgproto3/authentication_gss_continue.go:27 when the leading 4 bytes are not AuthTypeGSSCont (8). Defensive check redundant with frontend dispatch; firing means corruption or Decode called on bytes whose code is not 8.

Source

Thrown at pgproto3/authentication_gss_continue.go:27

)

type AuthenticationGSSContinue struct {
	Data []byte
}

func (a *AuthenticationGSSContinue) Backend() {}

func (a *AuthenticationGSSContinue) AuthenticationResponse() {}

func (a *AuthenticationGSSContinue) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeGSSCont {
		return errors.New("bad auth type")
	}

	a.Data = src[4:]
	return nil
}

func (a *AuthenticationGSSContinue) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeGSSCont)
	dst = append(dst, a.Data...)
	return finishMessage(dst, sp)
}

func (a *AuthenticationGSSContinue) MarshalJSON() ([]byte, error) {
	return json.Marshal(struct {
		Type string
		Data []byte
	}{

View on GitHub (pinned to ec1a0befd2)

Solutions

  1. Dispatch via findAuthenticationMessageType rather than a fixed struct.
  2. Switch on the auth code (8 => GSSContinue) when decoding manually.
  3. Do not alias/reuse the message buffer across decodes.
Defensive patterns

Strategy: validation

Validate before calling

if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSSCont {
    var m pgproto3.AuthenticationGSSContinue
    return m.Decode(body)
}

Type guard

func isGSSContinueFrame(body []byte) bool {
    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSSCont
}

Prevention

When it happens

Trigger: Manual/proxy code decoding a non-GSSContinue frame with the GSSContinue struct; buffer mutation; fuzz input.

Common situations: Custom GSS proxy/test hard-coding the wrong struct; corrupted reused buffer.

Related errors

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/b7e48d7854f535b3.json. Report an issue: GitHub.