jackc/pgx · error

bad gss encoding request code

Error message

bad gss encoding request code

What it means

Returned by GSSEncRequest.Decode when the first 4 bytes do not equal the GSS-encryption request magic number 80877104. That magic (0x04D21630) is how PostgreSQL distinguishes a GSS request from an SSL request (80877103), a cancel request (80877102), or a normal startup message on a fresh connection. A mismatch means the bytes are not a GSS request.

Source

Thrown at pgproto3/gss_enc_request.go:26

	"github.com/jackc/pgx/v5/internal/pgio"
)

const gssEncReqNumber = 80877104

type GSSEncRequest struct{}

// Frontend identifies this message as sendable by a PostgreSQL frontend.
func (*GSSEncRequest) Frontend() {}

func (dst *GSSEncRequest) Decode(src []byte) error {
	if len(src) < 4 {
		return errors.New("gss encoding request too short")
	}

	requestCode := binary.BigEndian.Uint32(src)

	if requestCode != gssEncReqNumber {
		return errors.New("bad gss encoding request code")
	}

	return nil
}

// Encode encodes src into dst. dst will include the 4 byte message length.
func (src *GSSEncRequest) Encode(dst []byte) ([]byte, error) {
	dst = pgio.AppendInt32(dst, 8)
	dst = pgio.AppendInt32(dst, gssEncReqNumber)
	return dst, nil
}

// MarshalJSON implements encoding/json.Marshaler.
func (src GSSEncRequest) MarshalJSON() ([]byte, error) {
	return json.Marshal(struct {
		Type            string
		ProtocolVersion uint32
		Parameters      map[string]string

View on GitHub (pinned to ec1a0befd2)

Solutions

1. Switch on the first uint32 before decoding: 80877103 → SSL, 80877104 → GSS, 80877102 → cancel, else → startup.
2. Verify bytes are read in big-endian (network) order.
3. Confirm the sender is actually issuing a GSS-encryption request (client sets gssencmode=require/prefer), not SSL or startup.
4. If proxying, track connection state so only a GSS code routes to the GSS decoder.

Example fix

// before
var gss pgproto3.GSSEncRequest
err := gss.Decode(body) // body was an SSL request (80877103)

// after
code := binary.BigEndian.Uint32(body)
switch code {
case 80877103: // SSL request
case 80877104: // GSS request
    var gss pgproto3.GSSEncRequest
    err := gss.Decode(body)
case 80877102: // cancel request
default: // startup message
}

func dispatchGSSCode(body []byte) error {
	if len(body) < 4 {
		return errors.New("frame too short for gss code")
	}
	switch binary.BigEndian.Uint32(body) {
	case 80877104: // GSS
		var g pgproto3.GSSEncRequest
		return g.Decode(body)
	case 80877103: // SSL
	case 80877102: // cancel
	default: // startup
	}
	return nil
}

null

null

When it happens

Trigger: `(*GSSEncRequest).Decode(src)` where `binary.BigEndian.Uint32(src) != 80877104`. Happens when an SSL request, cancel request, or startup packet is mistakenly fed to the GSS decoder, or when the bytes are corrupted.

Common situations: A proxy or test server reads the first int32 from a fresh connection and dispatches to GSSEncRequest.Decode without first switching on the code. Also caused by endianness mistakes or in-transit corruption.

Related errors

• bad cancel request code
• authentication message too short
• gss encoding request too short
• authentication message too short
• bad auth type

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /data/errors/0fcd94a49cab4100.json. Report an issue: GitHub.