Date: Tue, 17 Feb 2026 11:05:38 -0600
From: Nathan Bossart <nathandbossart@gmail.com>
To: Andreas Karlsson <andreas@proxel.se>
Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: add warning upon successful md5 password auth
Message-ID: <aZSf4sVYvSNCTcU5@nathan>
References: <aYzeAYEbodkkg5e-@nathan>
 <0731e3d8-3d13-4539-addc-a2c13a8b1b14@proxel.se>
 <aY9ewvQr4PBCVe0e@nathan>
 <3c4c95a2-c27b-4d9c-8eda-c96a17ba1d37@proxel.se>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="7EXlSGbrPZLhwNui"
Content-Disposition: inline
In-Reply-To: <3c4c95a2-c27b-4d9c-8eda-c96a17ba1d37@proxel.se>
Archived-At: <https://www.postgresql.org/message-id/aZSf4sVYvSNCTcU5%40nathan>
Precedence: bulk


--7EXlSGbrPZLhwNui
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Tue, Feb 17, 2026 at 07:08:17AM +0100, Andreas Karlsson wrote:
> After thinking more on the subject I have come around. I think warning spam
> (that can be disabled) is fine and why not introduce it directly in 19?

WFM

> As for the patch itself I think it looks good, but I am not a fan of the
> test code. Why not simply write like the below?
> 
> 	test_conn($node, 'user=md5_role', 'md5', 0,
> 		log_like =>
> 		  [qr/connection authenticated: identity="md5_role" method=md5/],
> 		expected_stderr =>
> 		  [qr/authenticated with an MD5-encrypted password/])

No good reason.  I've updated the patch.

-- 
nathan

--7EXlSGbrPZLhwNui
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment;
	filename=v2-0001-Warn-upon-successful-MD5-password-authentication.patch

From f55b97a4791c137f8c7271a45f7f6f19424b3d32 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Tue, 17 Feb 2026 10:20:47 -0600
Subject: [PATCH v2 1/1] Warn upon successful MD5 password authentication.

This uses the "connection warning" infrastructure introduced by
commit 1d92e0c2cc to emit a WARNING when an MD5 password is used to
authenticate.  MD5 password support was marked as deprecated in
v18 and will be removed in a future release of Postgres.  These
warnings are on by default but can be turned off via the existing
md5_password_warnings parameter.

Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Xiangyu Liang <liangxiangyu_2013@163.com>
Discussion: https://postgr.es/m/aYzeAYEbodkkg5e-%40nathan
---
 doc/src/sgml/config.sgml                  |  3 ++-
 src/backend/libpq/crypt.c                 | 17 +++++++++++++++++
 src/test/authentication/t/001_password.pl |  2 ++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index faf0bdb62aa..6e5a5364778 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,7 +1188,8 @@ include_dir 'conf.d'
       <listitem>
        <para>
         Controls whether a <literal>WARNING</literal> about MD5 password
-        deprecation is produced when a <command>CREATE ROLE</command> or
+        deprecation is produced upon successful MD5 password authentication or
+        when a <command>CREATE ROLE</command> or
         <command>ALTER ROLE</command> statement sets an MD5-encrypted password.
         The default value is <literal>on</literal>.
        </para>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41..37ccec355c7 100644
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
 	}
 
 	if (strcmp(client_pass, crypt_pwd) == 0)
+	{
 		retval = STATUS_OK;
+
+		if (md5_password_warnings)
+		{
+			MemoryContext oldcontext;
+			char	   *warning;
+			char	   *detail;
+
+			oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+			warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+			detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+			StoreConnectionWarning(warning, detail);
+
+			MemoryContextSwitchTo(oldcontext);
+		}
+	}
 	else
 	{
 		*logdetail = psprintf(_("Password does not match for user \"%s\"."),
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e8..a4b11673c26 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -499,6 +499,8 @@ SKIP:
 {
 	skip "MD5 not supported" unless $md5_works;
 	test_conn($node, 'user=md5_role', 'md5', 0,
+		expected_stderr =>
+		  qr/authenticated with an MD5-encrypted password/,
 		log_like =>
 		  [qr/connection authenticated: identity="md5_role" method=md5/]);
 }
-- 
2.50.1 (Apple Git-155)


--7EXlSGbrPZLhwNui--