Skip to content

Fix SCRAM auth: return after do_sasl consumes AuthenticationOk - #1

Merged
serprex merged 1 commit into
masterfrom
fix-scram-auth-loop
Jun 12, 2026
Merged

Fix SCRAM auth: return after do_sasl consumes AuthenticationOk#1
serprex merged 1 commit into
masterfrom
fix-scram-auth-loop

Conversation

@heavycrystal

Copy link
Copy Markdown
Contributor

do_sasl reads frames in its own loop and returns once it sees AuthenticationOk, but do_auth then continued looping and read the following BackendKeyData frame, hitting the catch-all and failing with "unexpected auth message". Sources configured with scram-sha-256 could not authenticate.

Return from do_auth immediately after do_sasl succeeds; the post-auth ParameterStatus/BackendKeyData/ReadyForQuery sequence is handled by await_ready_for_query as usual.

do_sasl reads frames in its own loop and returns once it sees
AuthenticationOk, but do_auth then continued looping and read the
following BackendKeyData frame, hitting the catch-all and failing
with "unexpected auth message". Sources configured with
scram-sha-256 could not authenticate.

Return from do_auth immediately after do_sasl succeeds; the
post-auth ParameterStatus/BackendKeyData/ReadyForQuery sequence is
handled by await_ready_for_query as usual.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes SCRAM-SHA-256 authentication flow in ReplicationConn by ensuring do_auth exits immediately after do_sasl completes (since do_sasl already consumes the AuthenticationOk), preventing subsequent post-auth startup frames (e.g., BackendKeyData) from being misclassified as “unexpected auth message”.

Changes:

  • Return early from do_auth after a successful do_sasl call, aligning control flow with how SCRAM messages are consumed.
  • Preserve the existing post-auth handling path via await_ready_for_query for ParameterStatus/BackendKeyData/ReadyForQuery.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@serprex
serprex merged commit 1cc4d50 into master Jun 12, 2026
40 checks passed
@serprex
serprex deleted the fix-scram-auth-loop branch June 20, 2026 00:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants