Skip to content

Allow SCRAM iteration counts <1000, and set maximum - #1444

Merged
arp242 merged 1 commit into
masterfrom
iter
Aug 16, 2026
Merged

Allow SCRAM iteration counts <1000, and set maximum#1444
arp242 merged 1 commit into
masterfrom
iter

Conversation

@arp242

@arp242 arp242 commented Aug 16, 2026

Copy link
Copy Markdown
Collaborator

Due to the "len(fields[2]) < 6", the iteration count had to be at least 4 digits and lower ones were rejected.

Add scram.Client.AcceptIterations() to set a lower and upper boundary instead. We could just fix it to accept any number, but using very low or very high values does not strike me as good, so require explicitly opting in.

The default minimum is 1000, because that was the de-facto minimum before this. Ideally I'd like to use 4096 (PostgreSQL default, recommended minimum in RFC 5802 and 7677), but that's not compatible.

RFC does not define an upper boundary; PostgreSQL does not seem to have one either. The value of 10 million was taken from pgx – that takes about 1.2s on my 7840U.


PostgreSQL does not support setting this from the connection string or environment. Expose it as "pqgo_scram_iterations=min,max" and "PQGOSCRAMITERATIONS=min,max". Prefixing it with pqgo clarifies this is a pq extension, and won't cause any headaches in the future if PostgreSQL adds this feature.

Closes #1296

Due to the "len(fields[2]) < 6", the iteration count had to be at least
4 digits and lower ones were rejected.

Add scram.Client.AcceptIterations() to set a lower and upper boundary
instead. We could just fix it to accept any number, but using very low
or very high values does not strike me as good, so require explicitly
opting in.

The default minimum is 1000, because that was the de-facto minimum
before this. Ideally I'd like to use 4096 (PostgreSQL default,
recommended minimum in RFC 5802 and 7677), but that's not compatible.

RFC does not define an upper boundary; PostgreSQL does not seem to have
one either. The value of 10 million was taken from pgx – that takes
about 1.2s on my 7840U.

---

PostgreSQL does not support setting this from the connection string or
environment. Expose it as "pqgo_scram_iterations=min,max" and
"PQGOSCRAMITERATIONS=min,max". Prefixing it with pqgo clarifies this is
a pq extension, and won't cause any headaches in the future if
PostgreSQL adds this feature.

Closes #1296
@arp242
arp242 merged commit 2835785 into master Aug 16, 2026
16 checks passed
@arp242
arp242 deleted the iter branch August 16, 2026 16:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant