Fix SCRAM-SHA-256 authentication by cloning the options object which is used to persist a nonce per connection (porsager#145)

marcbachmann · web-flow · commit 0709db43b5e2 · 2021-01-19T09:29:11.000+01:00
diff --git a/lib/index.js b/lib/index.js
@@ -218,7 +218,9 @@ function Postgres(a, b) {
 
   function createConnection(options) {
     slots--
-    const connection = Connection(options)
+    // The options object gets cloned as the as the authentication in the frontend.js mutates the
+    // options to persist a nonce and signature, which are unique per connection.
+    const connection = Connection({...options})
     all.push(connection)
     return connection
   }
diff --git a/tests/index.js b/tests/index.js
@@ -317,6 +317,15 @@ t('Login using scram-sha-256', async() => {
   return [true, (await postgres({ ...options, ...login_scram })`select true as x`)[0].x]
 })
 
+t('Parallel connections using scram-sha-256', async() => {
+  const sql = postgres({ ...options, ...login_scram })
+  return [true, (await Promise.all([
+    sql`select true as x, pg_sleep(0.2)`,
+    sql`select true as x, pg_sleep(0.2)`,
+    sql`select true as x, pg_sleep(0.2)`
+  ]))[0][0].x]
+})
+
 t('Support dynamic password function', async() => {
   return [true, (await postgres({
     ...options,
