jackc/pgx · error

bad authentication message size

Error message

bad authentication message size

What it means

Returned by AuthenticationMD5Password.Decode in pgproto3/authentication_md5_password.go:26 when the body is not exactly 8 bytes. The MD5 auth message is fixed-size: 4 bytes for the auth code (AuthTypeMD5Password = 5) plus 4 bytes for the salt. Any other length is a protocol violation; the salt (src[4:8]) could not be safely copied.

Source

Thrown at pgproto3/authentication_md5_password.go:26

	"github.com/jackc/pgx/v5/internal/pgio"
)

// AuthenticationMD5Password is a message sent from the backend indicating that an MD5 hashed password is required.
type AuthenticationMD5Password struct {
	Salt [4]byte
}

// Backend identifies this message as sendable by the PostgreSQL backend.
func (*AuthenticationMD5Password) Backend() {}

// Backend identifies this message as an authentication response.
func (*AuthenticationMD5Password) AuthenticationResponse() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *AuthenticationMD5Password) Decode(src []byte) error {
	if len(src) != 8 {
		return errors.New("bad authentication message size")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeMD5Password {
		return errors.New("bad auth type")
	}

	copy(dst.Salt[:], src[4:8])

	return nil
}

// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
func (src *AuthenticationMD5Password) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeMD5Password)
	dst = append(dst, src.Salt[:]...)

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Confirm a real PostgreSQL server is at the address (psql works).
2. Bypass pooler/proxy to rule out frame corruption.
3. In direct pgproto3 use, require len(body) == 8 before MD5 Decode.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "bad authentication message size") {
        return fmt.Errorf("malformed MD5 auth frame from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: Server/intermediary sends an MD5 auth frame with a body length other than 8; truncated stream; non-PostgreSQL responder; direct Decode on malformed bytes.

Common situations: Connecting to the wrong port/service whose greeting mimics 'R'; proxy mangling the startup frame; flaky link truncating the 8-byte body; fuzz input in a proxy.

Related errors

• bad authentication message size
• bad auth type
• bad authentication message size
• authentication message too short
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/83aa1bae2c015e13.json. Report an issue: GitHub.