authentication_timeout

Definition PG 18 manual

Maximum amount of time allowed to complete client authentication. If a would-be client has not completed the authentication protocol in this much time, the server closes the connection. This prevents hung clients from occupying a connection indefinitely. If this value is specified without units, it is taken as seconds. The default is one minute (1m). This parameter can only be set in the postgresql.conf file or on the server command line.

How it works

authentication_timeout sets the maximum allowed time to complete client authentication. The timer covers the authentication exchange before a normal backend session is established, limiting slots consumed by stalled or malicious handshakes.

authentication_timeout is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value.

The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services.

Operational considerations

Editing authentication_timeout without reloading configuration and verifying the effective value and subsequent behavior.

Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.

Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.

Changing authentication_timeout globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.

OLTP: Set authentication_timeout from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.

SMALL: Prefer the current secure default for authentication_timeout. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead.