jackc/pgx · error

invalid SASLInitialResponse

Error message

invalid SASLInitialResponse

What it means

Decode of a SASLInitialResponse frontend message could not find a NUL terminator for the auth mechanism name in the message body. The PostgreSQL wire protocol requires the mechanism string to be NUL-terminated; a truncated or malformed frame triggers this guard in pgproto3 decoding.

Solutions

1. Verify the client library sending the SASLInitialResponse frames the mechanism string with a trailing zero byte
2. Check for truncation or corruption of the message buffer passed to Decode
3. Capture the raw bytes and compare against a known-good SASLInitialResponse encoding

When it happens

Trigger: Thrown at pgproto3/sasl_initial_response.go:29 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jackc/pgx@ec1a0befd2 (2026-08-04). Data as JSON: /api/errors/8a131dba1a71921b. Report an issue: GitHub.

Appendix: source

Thrown at pgproto3/sasl_initial_response.go:29

type SASLInitialResponse struct {
	AuthMechanism string
	Data          []byte
}

// Frontend identifies this message as sendable by a PostgreSQL frontend.
func (*SASLInitialResponse) Frontend() {}

// Decode decodes src into dst. src must contain the complete message with the exception of the initial 1 byte message
// type identifier and 4 byte message length.
func (dst *SASLInitialResponse) Decode(src []byte) error {
	*dst = SASLInitialResponse{}

	rp := 0

	idx := bytes.IndexByte(src, 0)
	if idx < 0 {
		return errors.New("invalid SASLInitialResponse")
	}

	dst.AuthMechanism = string(src[rp:idx])
	rp = idx + 1

	if len(src[rp:]) < 4 {
		return errors.New("invalid SASLInitialResponse")
	}
	rp += 4 // The rest of the message is data so we can just skip the size
	dst.Data = src[rp:]

	return nil
}

// Encode encodes src into dst. dst will include the 1 byte message type identifier and the 4 byte message length.
func (src *SASLInitialResponse) Encode(dst []byte) ([]byte, error) {
	dst, sp := beginMessage(dst, 'p')

View on GitHub (pinned to ec1a0befd2)