postgres.git / summary / log / commit / refs

commit    bb8a88bbd1c7a9876b040e9eb54a77af192a52e3
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Fri Nov 06 20:56:10 2026 +0000

    doc: Clarify that OAuth bearer tokens are sent in clear text
    
    The bearer token used by OAUTHBEARER authentication is transmitted in
    clear text over the network, which makes it vulnerable to sniffing and
    similar attacks.  This adds a note that SSL connections are recommended
    for OAuth authentication.
    
    Backpatch down to v18 where OAuth was introduced.
    
    Author: Zsolt Parragi <zsolt.parragi@percona.com>
    Co-authored-by: Daniel Gustafsson <daniel@yesql.se>
    Discussion: https://postgr.es/m/CAN4CZFNy23wWKF+78QG3cfunjJpQWFc7eNP7qcYPB6Sg-NhTQQ@mail.gmail.com
    Backpatch-through: 18


 doc/src/sgml/client-auth.sgml |  8 ++++++--
 doc/src/sgml/protocol.sgml    | 10 ++++++++++
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index e4e65f8feb1..873ddd8f068 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -652,7 +652,9 @@ include_dir         <replaceable>directory</replaceable>
         <listitem>
          <para>
           Authorize and optionally authenticate using a third-party OAuth 2.0
-          identity provider. See <xref linkend="auth-oauth"/> for details.
+          identity provider.  Since the bearer token is sent in clear text over
+          the network, this should not be used on untrusted networks.  See
+          <xref linkend="auth-oauth"/> for details.
          </para>
         </listitem>
        </varlistentry>
@@ -2341,7 +2343,9 @@ host ... ldap ldapbasedn="dc=example,dc=net"
     <ulink url="https://datatracker.ietf.org/doc/html/rfc6750">RFC 6750</ulink>,
     which are a type of access token used with OAuth 2.0 where the token is an
     opaque string.  The format of the access token is implementation specific
-    and is chosen by each authorization server.
+    and is chosen by each authorization server.  The bearer token is sent
+    in clear-text, and is vulnerable to network sniffing.  For this reason
+    OAuth should only be used over SSL connections.
    </para>
 
    <para>
diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgml
index 84af9372ebe..541673eb282 100644
--- a/doc/src/sgml/protocol.sgml
+++ b/doc/src/sgml/protocol.sgml
@@ -2084,6 +2084,16 @@ SELCT 1/0;<!-- this typo is intentional -->
     server.
    </para>
 
+   <note>
+    <para>
+     The bearer token is sent across the connection, as part of the client
+     initial response, and grants access to the database like a clear-text
+     password. On an unencrypted connection it can be captured by network
+     sniffing. For this reason <literal>OAUTHBEARER</literal> should only be
+     used over SSL connections.
+    </para>
+   </note>
+
    <para>
     <literal>OAUTHBEARER</literal> does not support channel binding, and there
     is no "OAUTHBEARER-PLUS" mechanism. This mechanism does not make use of


[parent: d073ddd5180d]