Skip to content

Conversation

clue
Copy link
Contributor

@clue clue commented May 22, 2025

This changeset adds support for the AuthSwitchRequest to switch authentication plugins. The MySQL server can send this packet to ask the client to use another authentication method (https://dev.mysql.com/doc/dev/mysql-server/latest/page_protocol_connection_phase_packets_protocol_auth_switch_request.html).

For instance, this is required to make Amazon RDS work in my tests. In my tests, the server first requests mysql_native_password which is then fulfilled by the client, and next switches to caching_sha2_password afterwards, asking the client to authenticate again. While I agree this may look strange, it may make sense depending on server configuration internals and is completely in line with the MySQL protocol specification.

With these changes applied, I can successfully connect to my Amazon RDS server and process any queries as usual. Prior to applying these changes, I would get a protocol exception instead:

Connection to mysql://user:***@example.amazonaws.com:3306/example failed during authentication: Unexpected protocol error, received malformed packet with 39 unknown byte(s)

The affected code has 100% code coverage and has been tested against a number of MySQL server versions. The tests confirm it should continue to work for legacy servers not using authentication plugins or newer MySQL server versions using the existing mysql_native_password authentication or newer caching_sha2_password authentication. As discussed in #196 and elsewhere, I'll follow-up with a separate PR to add more MySQL server versions to our test matrix, but I've yet to find a combination that requires the AuthSwitchRequest.

Builds on top of #207 and #206

@clue clue added this to the v0.7.0 milestone May 22, 2025
@clue clue requested a review from WyriHaximus May 22, 2025 20:47
Copy link
Member

@WyriHaximus WyriHaximus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🏎️

@WyriHaximus WyriHaximus merged commit a134348 into friends-of-reactphp:0.7.x May 22, 2025
15 checks passed
@clue clue deleted the auth-switch branch May 22, 2025 20:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants