jackc/pgx · error

bad authentication message size

Error message

bad authentication message size

What it means

Returned by AuthenticationOk.Decode in pgproto3/authentication_ok.go:24 when the 'R' message body is not exactly 4 bytes. AuthenticationOk carries only the 4-byte auth code (AuthTypeOk = 0) signalling successful auth, so any other length is a protocol violation.

Source

Thrown at pgproto3/authentication_ok.go:24

	"errors"

	"github.com/jackc/pgx/v5/internal/pgio"
)

// AuthenticationOk is a message sent from the backend indicating that authentication was successful.
type AuthenticationOk struct{}

// Backend identifies this message as sendable by the PostgreSQL backend.
func (*AuthenticationOk) Backend() {}

// Backend identifies this message as an authentication response.
func (*AuthenticationOk) AuthenticationResponse() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *AuthenticationOk) Decode(src []byte) error {
	if len(src) != 4 {
		return errors.New("bad authentication message size")
	}

	authType := binary.BigEndian.Uint32(src)

	if authType != AuthTypeOk {
		return errors.New("bad auth type")
	}

	return nil
}

// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
func (src *AuthenticationOk) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'R')
	dst = pgio.AppendUint32(dst, AuthTypeOk)
	return finishMessage(dst, sp)
}

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Verify the endpoint is a genuine PostgreSQL server.
2. Bypass intermediaries and retry the connection.
3. Validate len(body) == 4 before Decode in custom pgproto3 code.

conn, err := pgconn.Connect(ctx, connString)
if err != nil {
    if strings.Contains(err.Error(), "bad authentication message size") {
        return fmt.Errorf("malformed AuthenticationOk frame from %s: %w", connString, err)
    }
    return err
}

When it happens

Trigger: Server/intermediary sends an AuthenticationOk frame whose body is not 4 bytes; truncated/garbled stream; non-PostgreSQL responder; direct Decode on malformed bytes. This is the terminal 'auth succeeded' message, so corruption here usually means the whole handshake is bogus.

Common situations: Wrong-port service impersonating Postgres; proxy corrupting the final auth frame; packet corruption; fuzz input.

Related errors

• bad authentication message size
• bad authentication message size
• bad auth type
• authentication message too short
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/f88e9b3ea0a57edd.json. Report an issue: GitHub.