]> git.ipfire.org Git - thirdparty/postgresql.git/commit
oauth: Don't log discovery connections by default
authorJacob Champion <jchampion@postgresql.org>
Tue, 31 Mar 2026 18:47:33 +0000 (11:47 -0700)
committerJacob Champion <jchampion@postgresql.org>
Tue, 31 Mar 2026 18:47:33 +0000 (11:47 -0700)
commite020a897efeaed52cd3f5fef7f933cb5dc6cbfaf
tree78560d69cdc7f8b5d1a3b445bdcde2d69c824a94
parentc4ff16339f07d1e253bdf18e5da5fa25f62a750d
oauth: Don't log discovery connections by default

Currently, when the client sends a parameter discovery request within
OAUTHBEARER, the server logs the attempt with

    FATAL:  OAuth bearer authentication failed for user

These log entries are difficult to distinguish from true authentication
failures, and by default, libpq sends a discovery request as part of
every OAuth connection, making them annoyingly noisy. Use the new
PG_SASL_EXCHANGE_ABANDONED status to suppress them.

Patch by Zsolt Parragi, with some additional comments added by me.

Author: Zsolt Parragi <zsolt.parragi@percona.com>
Reviewed-by: Andrey Borodin <x4mmm@yandex-team.ru>
Reviewed-by: Chao Li <li.evan.chao@gmail.com>
Discussion: https://postgr.es/m/CAN4CZFPim7hUiyb7daNKQPSZ8CvQRBGkVhbvED7yZi8VktSn4Q%40mail.gmail.com
src/backend/libpq/auth-oauth.c
src/test/modules/oauth_validator/t/001_server.pl