jackc/pgx · error

bad auth type

Error message

bad auth type

What it means

Returned by AuthenticationGSS.Decode in pgproto3/authentication_gss.go:25 when the leading 4 bytes are not AuthTypeGSS (7). Redundant with the frontend's dispatch; firing means corruption after dispatch or Decode invoked manually on a frame whose code is not 7 (e.g. SASL or GSSContinue bytes fed to the GSS struct).

Source

Thrown at pgproto3/authentication_gss.go:25

	"github.com/jackc/pgx/v5/internal/pgio"
)

type AuthenticationGSS struct{}

func (a *AuthenticationGSS) Backend() {}

func (a *AuthenticationGSS) AuthenticationResponse() {}

func (a *AuthenticationGSS) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("authentication message too short")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeGSS {
		return errors.New("bad auth type")
	}
	return nil
}

func (a *AuthenticationGSS) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeGSS)
	return finishMessage(dst, sp)
}

func (a *AuthenticationGSS) MarshalJSON() ([]byte, error) {
	return json.Marshal(struct {
		Type string
		Data []byte
	}{
		Type: "AuthenticationGSS",
	})
}

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Use findAuthenticationMessageType / Frontend.Receive for dispatch instead of a fixed struct.
2. When decoding manually, switch on the 4-byte auth code (7 => GSS, 8 => GSSContinue).
3. Avoid reusing the underlying byte buffer across messages.

if len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSS {
    var m pgproto3.AuthenticationGSS
    return m.Decode(body)
}

func isGSSAuthFrame(body []byte) bool {
    return len(body) >= 4 && binary.BigEndian.Uint32(body) == pgproto3.AuthTypeGSS
}

When it happens

Trigger: Manual/proxy code decoding a non-GSS frame with the GSS struct; buffer mutation; fuzz input.

Common situations: Custom GSS proxy or test that hard-codes the wrong struct; corrupted buffer reused across decode calls.

Related errors

• bad auth type
• authentication message too short
• authentication message too short
• bad auth type
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/d6c6aae7b3bd2fc7.json. Report an issue: GitHub.