porsager / postgres

Postgres.js - The Fastest full featured PostgreSQL client for Node.js, Deno, Bun and CloudFlare
The Unlicense
7.26k stars 262 forks source link

Password with special characters #680

Closed gitsemaphore closed 10 months ago

gitsemaphore commented 11 months ago

When passing a password with special character, it resulted in PostgresError: password authentication failed for user "dbuser"

The common standard is to use percentEncodeAllChars or encodeURIComponent and I have tried that as well. Both using connection string and object. It still resulted in the same password authentication error.

The same login and password works fine with psql on command line.

Is there away to pass the password when it contain special characters?

porsager commented 11 months ago

Have you tried using the object to pass the password like this?

const sql = postgres({
  password: 'hereÅspecialPøsswærd'
}}

Even so - urls are supposed to work with passwords that are URI encoded, and options.password should just take it raw.

gitsemaphore commented 11 months ago

Yes I have tried object based way of passing the password. It still complains that the password is incorrect. I also noticed that only had problem with certain characters in unicode. For example "£" is fine, but other unicode such as '◌̈' doesn't work. As soonest I took out the character then it works.

The same has being tried with psql.

This is the version of postgres that is running on RDS.

PostgreSQL 14.5 on aarch64-unknown-linux-gnu, compiled by aarch64-unknown-linux-gnu-gcc (GCC) 7.4.0, 64-bit

porsager commented 11 months ago

I've just tried using ◌̈ in both url and password option with both md5 and scram-sha-256, and that works fine. Is there any way you can provide a reproducible sample?

boromisp commented 11 months ago

Debug suggestion: normalization matters when it comes to unicode. For example 'ö' could be either '\u006F\u0308' (NFD), or '\u00F6' (NFC) depending on the normalization form.

Try to normalize (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/normalize) the password in different ways before passing it to the library, to detect if this caused the issue.

porsager commented 10 months ago

That's a good point @boromisp ! I'm not sure that's something for this library to handle though.

Feel free to reopen if that's wrong.