pg.ddx.io pgsql-hackers@postgresql.org mailing list archive
help / color / mirror / Atom feedadd warning upon successful md5 password auth
10+ messages / 4 participants
[nested] [flat]
* add warning upon successful md5 password auth
@ 2026-02-11 19:52 Nathan Bossart <nathandbossart@gmail.com>
0 siblings, 2 replies; 10+ messages in thread
From: Nathan Bossart @ 2026-02-11 19:52 UTC (permalink / raw)
To: pgsql-hackers
From a related discussion last year [0]:
On Tue, Jun 03, 2025 at 12:09:50PM -0500, Nathan Bossart wrote:
> On Tue, Jun 03, 2025 at 09:43:59AM -0500, Nathan Bossart wrote:
>> On Tue, Jun 03, 2025 at 10:34:06AM -0400, Tom Lane wrote:
>>> If we really want to be in peoples' face about this, the thing
>>> to do is to print a warning every time they log in with an MD5
>>> password. Also, to Michael's point, that really would be exactly
>>> the same place where the eventual "sorry, not supported anymore"
>>> message will be.
>>
>> I held off on this because I was worried it might be far too noisy. That
>> does seem like it has the best chance of getting folks' attention, though.
>> If it's too noisy, users can always turn off the warnings.
>
> Here is a draft-grade patch that adds a WARNING upon successful
> authentication with an MD5 password. It's a little hacky because AFAICT we
> need to wait until well after authentication (for GUCs to be set up, etc.)
> before we actually emit the WARNING. When the time comes to remove MD5
> password support completely, we'll need to do something like modify
> CheckMD5Auth() to always return STATUS_ERROR with an appropriate logdetail
> message.
Since I just added a "connection warnings" infrastructure in commit
1d92e0c2cc, I thought it might be a good time to revisit this idea.
Attached is an updated patch. I'm not sure this is v19 material. It could
make sense to wait until v20 or something. But I figured it was worth at
least having the discussion.
[0] https://postgr.es/m/aD8sXgfJeIGLc7-t%40nathan
--
nathan
From 5a80bd6f98c7f83dc9e1fef56c71be2f5570ba29 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Wed, 11 Feb 2026 11:56:15 -0600
Subject: [PATCH v1 1/1] Add warning upon successful MD5 password
authentication.
---
doc/src/sgml/config.sgml | 7 ++++---
src/backend/libpq/crypt.c | 17 +++++++++++++++++
src/test/authentication/t/001_password.pl | 7 ++++---
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 6bc2690ce07..a1f3ca65ed2 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,9 +1188,10 @@ include_dir 'conf.d'
<listitem>
<para>
Controls whether a <literal>WARNING</literal> about MD5 password
- deprecation is produced when a <command>CREATE ROLE</command> or
- <command>ALTER ROLE</command> statement sets an MD5-encrypted password.
- The default value is <literal>on</literal>.
+ deprecation is produced upon successful MD5 password authentication or
+ when a <command>CREATE ROLE</command> or <command>ALTER ROLE</command>
+ statement sets an MD5-encrypted password. The default value is
+ <literal>on</literal>.
</para>
</listitem>
</varlistentry>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41..37ccec355c7 100644
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
}
if (strcmp(client_pass, crypt_pwd) == 0)
+ {
retval = STATUS_OK;
+
+ if (md5_password_warnings)
+ {
+ MemoryContext oldcontext;
+ char *warning;
+ char *detail;
+
+ oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+ warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+ detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+ StoreConnectionWarning(warning, detail);
+
+ MemoryContextSwitchTo(oldcontext);
+ }
+ }
else
{
*logdetail = psprintf(_("Password does not match for user \"%s\"."),
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e8..45f9f3504f7 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -498,9 +498,10 @@ test_conn($node, 'user=scram_role', 'md5', 0,
SKIP:
{
skip "MD5 not supported" unless $md5_works;
- test_conn($node, 'user=md5_role', 'md5', 0,
- log_like =>
- [qr/connection authenticated: identity="md5_role" method=md5/]);
+ my @test_params = ();
+ push @test_params, log_like => [qr/connection authenticated: identity="md5_role" method=md5/];
+ push @test_params, expected_stderr => qr/authenticated with an MD5-encrypted password/;
+ test_conn($node, 'user=md5_role', 'md5', 0, @test_params);
}
# require_auth succeeds with SCRAM required.
--
2.50.1 (Apple Git-155)
Attachments:
[text/plain] v1-0001-Add-warning-upon-successful-MD5-password-authenti.patch (3.0K, ../../aYzeAYEbodkkg5e-@nathan/2-v1-0001-Add-warning-upon-successful-MD5-password-authenti.patch)
download | inline diff:
From 5a80bd6f98c7f83dc9e1fef56c71be2f5570ba29 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Wed, 11 Feb 2026 11:56:15 -0600
Subject: [PATCH v1 1/1] Add warning upon successful MD5 password
authentication.
---
doc/src/sgml/config.sgml | 7 ++++---
src/backend/libpq/crypt.c | 17 +++++++++++++++++
src/test/authentication/t/001_password.pl | 7 ++++---
3 files changed, 25 insertions(+), 6 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 6bc2690ce07..a1f3ca65ed2 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,9 +1188,10 @@ include_dir 'conf.d'
<listitem>
<para>
Controls whether a <literal>WARNING</literal> about MD5 password
- deprecation is produced when a <command>CREATE ROLE</command> or
- <command>ALTER ROLE</command> statement sets an MD5-encrypted password.
- The default value is <literal>on</literal>.
+ deprecation is produced upon successful MD5 password authentication or
+ when a <command>CREATE ROLE</command> or <command>ALTER ROLE</command>
+ statement sets an MD5-encrypted password. The default value is
+ <literal>on</literal>.
</para>
</listitem>
</varlistentry>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41..37ccec355c7 100644
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
}
if (strcmp(client_pass, crypt_pwd) == 0)
+ {
retval = STATUS_OK;
+
+ if (md5_password_warnings)
+ {
+ MemoryContext oldcontext;
+ char *warning;
+ char *detail;
+
+ oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+ warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+ detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+ StoreConnectionWarning(warning, detail);
+
+ MemoryContextSwitchTo(oldcontext);
+ }
+ }
else
{
*logdetail = psprintf(_("Password does not match for user \"%s\"."),
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e8..45f9f3504f7 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -498,9 +498,10 @@ test_conn($node, 'user=scram_role', 'md5', 0,
SKIP:
{
skip "MD5 not supported" unless $md5_works;
- test_conn($node, 'user=md5_role', 'md5', 0,
- log_like =>
- [qr/connection authenticated: identity="md5_role" method=md5/]);
+ my @test_params = ();
+ push @test_params, log_like => [qr/connection authenticated: identity="md5_role" method=md5/];
+ push @test_params, expected_stderr => qr/authenticated with an MD5-encrypted password/;
+ test_conn($node, 'user=md5_role', 'md5', 0, @test_params);
}
# require_auth succeeds with SCRAM required.
--
2.50.1 (Apple Git-155)
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re:add warning upon successful md5 password auth
@ 2026-02-12 02:22 Xiangyu Liang <liangxiangyu_2013@163.com>
parent: Nathan Bossart <nathandbossart@gmail.com>
1 sibling, 0 replies; 10+ messages in thread
From: Xiangyu Liang @ 2026-02-12 02:22 UTC (permalink / raw)
To: Nathan Bossart <nathandbossart@gmail.com>; +Cc: pgsql-hackers
At 2026-02-12 03:52:33, "Nathan Bossart" <nathandbossart@gmail.com> wrote:
>From a related discussion last year [0]:
>
>On Tue, Jun 03, 2025 at 12:09:50PM -0500, Nathan Bossart wrote:
>> On Tue, Jun 03, 2025 at 09:43:59AM -0500, Nathan Bossart wrote:
>>> On Tue, Jun 03, 2025 at 10:34:06AM -0400, Tom Lane wrote:
>>>> If we really want to be in peoples' face about this, the thing
>>>> to do is to print a warning every time they log in with an MD5
>>>> password. Also, to Michael's point, that really would be exactly
>>>> the same place where the eventual "sorry, not supported anymore"
>>>> message will be.
>>>
>>> I held off on this because I was worried it might be far too noisy. That
>>> does seem like it has the best chance of getting folks' attention, though.
>>> If it's too noisy, users can always turn off the warnings.
>>
>> Here is a draft-grade patch that adds a WARNING upon successful
>> authentication with an MD5 password. It's a little hacky because AFAICT we
>> need to wait until well after authentication (for GUCs to be set up, etc.)
>> before we actually emit the WARNING. When the time comes to remove MD5
>> password support completely, we'll need to do something like modify
>> CheckMD5Auth() to always return STATUS_ERROR with an appropriate logdetail
>> message.
>
>Since I just added a "connection warnings" infrastructure in commit
>1d92e0c2cc, I thought it might be a good time to revisit this idea.
>Attached is an updated patch. I'm not sure this is v19 material. It could
>make sense to wait until v20 or something. But I figured it was worth at
>least having the discussion.
>
>[0] https://postgr.es/m/aD8sXgfJeIGLc7-t%40nathan
>
>--
>nathan
This looks like a solid patch. I’ve taken a look and don’t have any comments.
I applied it locally and the build went through without any issues.
I also ran the new TAP test case, and everything looks good on my side.
Regards,
Xiangyu Liang
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-13 05:04 Andreas Karlsson <andreas@proxel.se>
parent: Nathan Bossart <nathandbossart@gmail.com>
1 sibling, 1 reply; 10+ messages in thread
From: Andreas Karlsson @ 2026-02-13 05:04 UTC (permalink / raw)
To: Nathan Bossart <nathandbossart@gmail.com>; pgsql-hackers
On 2/11/26 8:52 PM, Nathan Bossart wrote:
> Since I just added a "connection warnings" infrastructure in commit
> 1d92e0c2cc, I thought it might be a good time to revisit this idea.
> Attached is an updated patch. I'm not sure this is v19 material. It could
> make sense to wait until v20 or something. But I figured it was worth at
> least having the discussion.
The patch looks good and I think it would make sense to merge it in 19,
why wait for 20? But the main question I see is if this is too noisy or
not. Some applications connected to PostgreSQL quite a lot and I am sure
we would make some users unhappy so I am not fully on board with this
patch. But on the other hand we have way too many people who still use
md5 and we really should push them towards using scram.
Andreas
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-13 17:26 Nathan Bossart <nathandbossart@gmail.com>
parent: Andreas Karlsson <andreas@proxel.se>
0 siblings, 2 replies; 10+ messages in thread
From: Nathan Bossart @ 2026-02-13 17:26 UTC (permalink / raw)
To: Andreas Karlsson <andreas@proxel.se>; +Cc: pgsql-hackers
On Fri, Feb 13, 2026 at 06:04:14AM +0100, Andreas Karlsson wrote:
> The patch looks good and I think it would make sense to merge it in 19, why
> wait for 20? But the main question I see is if this is too noisy or not.
> Some applications connected to PostgreSQL quite a lot and I am sure we would
> make some users unhappy so I am not fully on board with this patch. But on
> the other hand we have way too many people who still use md5 and we really
> should push them towards using scram.
FWIW if users are really annoyed with these warnings, they can disable them
by setting md5_password_warnings to off. But I think we really ought to do
something like $subject before we completely remove MD5 password support.
--
nathan
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-13 17:43 Tom Lane <tgl@sss.pgh.pa.us>
parent: Nathan Bossart <nathandbossart@gmail.com>
1 sibling, 0 replies; 10+ messages in thread
From: Tom Lane @ 2026-02-13 17:43 UTC (permalink / raw)
To: Nathan Bossart <nathandbossart@gmail.com>; +Cc: Andreas Karlsson <andreas@proxel.se>; pgsql-hackers
Nathan Bossart <nathandbossart@gmail.com> writes:
> On Fri, Feb 13, 2026 at 06:04:14AM +0100, Andreas Karlsson wrote:
>> The patch looks good and I think it would make sense to merge it in 19, why
>> wait for 20? But the main question I see is if this is too noisy or not.
>> Some applications connected to PostgreSQL quite a lot and I am sure we would
>> make some users unhappy so I am not fully on board with this patch. But on
>> the other hand we have way too many people who still use md5 and we really
>> should push them towards using scram.
> FWIW if users are really annoyed with these warnings, they can disable them
> by setting md5_password_warnings to off. But I think we really ought to do
> something like $subject before we completely remove MD5 password support.
+1. We need something like this to be there for at least a year or
two before we can consider removing MD5 passwords entirely. As long
as the warnings can be turned off, I think it's all right and indeed
necessary to have them on-by-default.
regards, tom lane
PS: I've not read the patch, so this isn't an endorsement of details.
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-17 06:08 Andreas Karlsson <andreas@proxel.se>
parent: Nathan Bossart <nathandbossart@gmail.com>
1 sibling, 1 reply; 10+ messages in thread
From: Andreas Karlsson @ 2026-02-17 06:08 UTC (permalink / raw)
To: Nathan Bossart <nathandbossart@gmail.com>; +Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
On 2/13/26 6:26 PM, Nathan Bossart wrote:
> On Fri, Feb 13, 2026 at 06:04:14AM +0100, Andreas Karlsson wrote:
>> The patch looks good and I think it would make sense to merge it in 19, why
>> wait for 20? But the main question I see is if this is too noisy or not.
>> Some applications connected to PostgreSQL quite a lot and I am sure we would
>> make some users unhappy so I am not fully on board with this patch. But on
>> the other hand we have way too many people who still use md5 and we really
>> should push them towards using scram.
>
> FWIW if users are really annoyed with these warnings, they can disable them
> by setting md5_password_warnings to off. But I think we really ought to do
> something like $subject before we completely remove MD5 password support.
After thinking more on the subject I have come around. I think warning
spam (that can be disabled) is fine and why not introduce it directly in 19?
As for the patch itself I think it looks good, but I am not a fan of the
test code. Why not simply write like the below?
test_conn($node, 'user=md5_role', 'md5', 0,
log_like =>
[qr/connection authenticated: identity="md5_role" method=md5/],
expected_stderr =>
[qr/authenticated with an MD5-encrypted password/])
Andreas
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-17 17:05 Nathan Bossart <nathandbossart@gmail.com>
parent: Andreas Karlsson <andreas@proxel.se>
0 siblings, 1 reply; 10+ messages in thread
From: Nathan Bossart @ 2026-02-17 17:05 UTC (permalink / raw)
To: Andreas Karlsson <andreas@proxel.se>; +Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
On Tue, Feb 17, 2026 at 07:08:17AM +0100, Andreas Karlsson wrote:
> After thinking more on the subject I have come around. I think warning spam
> (that can be disabled) is fine and why not introduce it directly in 19?
WFM
> As for the patch itself I think it looks good, but I am not a fan of the
> test code. Why not simply write like the below?
>
> test_conn($node, 'user=md5_role', 'md5', 0,
> log_like =>
> [qr/connection authenticated: identity="md5_role" method=md5/],
> expected_stderr =>
> [qr/authenticated with an MD5-encrypted password/])
No good reason. I've updated the patch.
--
nathan
From f55b97a4791c137f8c7271a45f7f6f19424b3d32 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Tue, 17 Feb 2026 10:20:47 -0600
Subject: [PATCH v2 1/1] Warn upon successful MD5 password authentication.
This uses the "connection warning" infrastructure introduced by
commit 1d92e0c2cc to emit a WARNING when an MD5 password is used to
authenticate. MD5 password support was marked as deprecated in
v18 and will be removed in a future release of Postgres. These
warnings are on by default but can be turned off via the existing
md5_password_warnings parameter.
Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Xiangyu Liang <liangxiangyu_2013@163.com>
Discussion: https://postgr.es/m/aYzeAYEbodkkg5e-%40nathan
---
doc/src/sgml/config.sgml | 3 ++-
src/backend/libpq/crypt.c | 17 +++++++++++++++++
src/test/authentication/t/001_password.pl | 2 ++
3 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index faf0bdb62aa..6e5a5364778 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,7 +1188,8 @@ include_dir 'conf.d'
<listitem>
<para>
Controls whether a <literal>WARNING</literal> about MD5 password
- deprecation is produced when a <command>CREATE ROLE</command> or
+ deprecation is produced upon successful MD5 password authentication or
+ when a <command>CREATE ROLE</command> or
<command>ALTER ROLE</command> statement sets an MD5-encrypted password.
The default value is <literal>on</literal>.
</para>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41..37ccec355c7 100644
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
}
if (strcmp(client_pass, crypt_pwd) == 0)
+ {
retval = STATUS_OK;
+
+ if (md5_password_warnings)
+ {
+ MemoryContext oldcontext;
+ char *warning;
+ char *detail;
+
+ oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+ warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+ detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+ StoreConnectionWarning(warning, detail);
+
+ MemoryContextSwitchTo(oldcontext);
+ }
+ }
else
{
*logdetail = psprintf(_("Password does not match for user \"%s\"."),
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e8..a4b11673c26 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -499,6 +499,8 @@ SKIP:
{
skip "MD5 not supported" unless $md5_works;
test_conn($node, 'user=md5_role', 'md5', 0,
+ expected_stderr =>
+ qr/authenticated with an MD5-encrypted password/,
log_like =>
[qr/connection authenticated: identity="md5_role" method=md5/]);
}
--
2.50.1 (Apple Git-155)
Attachments:
[text/plain] v2-0001-Warn-upon-successful-MD5-password-authentication.patch (3.0K, ../../aZSf4sVYvSNCTcU5@nathan/2-v2-0001-Warn-upon-successful-MD5-password-authentication.patch)
download | inline diff:
From f55b97a4791c137f8c7271a45f7f6f19424b3d32 Mon Sep 17 00:00:00 2001
From: Nathan Bossart <nathan@postgresql.org>
Date: Tue, 17 Feb 2026 10:20:47 -0600
Subject: [PATCH v2 1/1] Warn upon successful MD5 password authentication.
This uses the "connection warning" infrastructure introduced by
commit 1d92e0c2cc to emit a WARNING when an MD5 password is used to
authenticate. MD5 password support was marked as deprecated in
v18 and will be removed in a future release of Postgres. These
warnings are on by default but can be turned off via the existing
md5_password_warnings parameter.
Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Xiangyu Liang <liangxiangyu_2013@163.com>
Discussion: https://postgr.es/m/aYzeAYEbodkkg5e-%40nathan
---
doc/src/sgml/config.sgml | 3 ++-
src/backend/libpq/crypt.c | 17 +++++++++++++++++
src/test/authentication/t/001_password.pl | 2 ++
3 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index faf0bdb62aa..6e5a5364778 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1188,7 +1188,8 @@ include_dir 'conf.d'
<listitem>
<para>
Controls whether a <literal>WARNING</literal> about MD5 password
- deprecation is produced when a <command>CREATE ROLE</command> or
+ deprecation is produced upon successful MD5 password authentication or
+ when a <command>CREATE ROLE</command> or
<command>ALTER ROLE</command> statement sets an MD5-encrypted password.
The default value is <literal>on</literal>.
</para>
diff --git a/src/backend/libpq/crypt.c b/src/backend/libpq/crypt.c
index dbdd0e40f41..37ccec355c7 100644
--- a/src/backend/libpq/crypt.c
+++ b/src/backend/libpq/crypt.c
@@ -294,7 +294,24 @@ md5_crypt_verify(const char *role, const char *shadow_pass,
}
if (strcmp(client_pass, crypt_pwd) == 0)
+ {
retval = STATUS_OK;
+
+ if (md5_password_warnings)
+ {
+ MemoryContext oldcontext;
+ char *warning;
+ char *detail;
+
+ oldcontext = MemoryContextSwitchTo(TopMemoryContext);
+
+ warning = pstrdup(_("authenticated with an MD5-encrypted password"));
+ detail = pstrdup(_("MD5 password support is deprecated and will be removed in a future release of PostgreSQL."));
+ StoreConnectionWarning(warning, detail);
+
+ MemoryContextSwitchTo(oldcontext);
+ }
+ }
else
{
*logdetail = psprintf(_("Password does not match for user \"%s\"."),
diff --git a/src/test/authentication/t/001_password.pl b/src/test/authentication/t/001_password.pl
index 0ec9aa9f4e8..a4b11673c26 100644
--- a/src/test/authentication/t/001_password.pl
+++ b/src/test/authentication/t/001_password.pl
@@ -499,6 +499,8 @@ SKIP:
{
skip "MD5 not supported" unless $md5_works;
test_conn($node, 'user=md5_role', 'md5', 0,
+ expected_stderr =>
+ qr/authenticated with an MD5-encrypted password/,
log_like =>
[qr/connection authenticated: identity="md5_role" method=md5/]);
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-17 17:11 Andreas Karlsson <andreas@proxel.se>
parent: Nathan Bossart <nathandbossart@gmail.com>
0 siblings, 1 reply; 10+ messages in thread
From: Andreas Karlsson @ 2026-02-17 17:11 UTC (permalink / raw)
To: Nathan Bossart <nathandbossart@gmail.com>; +Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
On 2/17/26 6:05 PM, Nathan Bossart wrote:
> On Tue, Feb 17, 2026 at 07:08:17AM +0100, Andreas Karlsson wrote:
>> As for the patch itself I think it looks good, but I am not a fan of the
>> test code. Why not simply write like the below?
>>
>> test_conn($node, 'user=md5_role', 'md5', 0,
>> log_like =>
>> [qr/connection authenticated: identity="md5_role" method=md5/],
>> expected_stderr =>
>> [qr/authenticated with an MD5-encrypted password/])
>
> No good reason. I've updated the patch.
Nice, the patch looks good as-is for me now.
Andreas
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-17 21:00 Nathan Bossart <nathandbossart@gmail.com>
parent: Andreas Karlsson <andreas@proxel.se>
0 siblings, 1 reply; 10+ messages in thread
From: Nathan Bossart @ 2026-02-17 21:00 UTC (permalink / raw)
To: Andreas Karlsson <andreas@proxel.se>; +Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
On Tue, Feb 17, 2026 at 06:11:45PM +0100, Andreas Karlsson wrote:
> Nice, the patch looks good as-is for me now.
Thanks for reviewing. I'm going to let this sit for a little while longer
in case anyone else has feedback, but my current plan is to commit it for
v19.
--
nathan
^ permalink raw reply [nested|flat] 10+ messages in thread
* Re: add warning upon successful md5 password auth
@ 2026-02-23 17:23 Nathan Bossart <nathandbossart@gmail.com>
parent: Nathan Bossart <nathandbossart@gmail.com>
0 siblings, 0 replies; 10+ messages in thread
From: Nathan Bossart @ 2026-02-23 17:23 UTC (permalink / raw)
To: Andreas Karlsson <andreas@proxel.se>; +Cc: pgsql-hackers@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Committed.
--
nathan
^ permalink raw reply [nested|flat] 10+ messages in thread
end of thread, other threads:[~2026-02-23 17:23 UTC | newest]
Thread overview: 10+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2026-02-11 19:52 add warning upon successful md5 password auth Nathan Bossart <nathandbossart@gmail.com>
2026-02-12 02:22 ` Xiangyu Liang <liangxiangyu_2013@163.com>
2026-02-13 05:04 ` Andreas Karlsson <andreas@proxel.se>
2026-02-13 17:26 ` Nathan Bossart <nathandbossart@gmail.com>
2026-02-13 17:43 ` Tom Lane <tgl@sss.pgh.pa.us>
2026-02-17 06:08 ` Andreas Karlsson <andreas@proxel.se>
2026-02-17 17:05 ` Nathan Bossart <nathandbossart@gmail.com>
2026-02-17 17:11 ` Andreas Karlsson <andreas@proxel.se>
2026-02-17 21:00 ` Nathan Bossart <nathandbossart@gmail.com>
2026-02-23 17:23 ` Nathan Bossart <nathandbossart@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox