{"Entry":{"collection":"guc","key":"authentication_timeout","name":"authentication_timeout","aliases":[],"metadata":{"baseline":true,"boot_human":"Not specified","boot_val":null,"category":"Connections and Authentication / Authentication","category_zh":"","changed_in":["11"],"changes":[{"documentation_changed":true,"fields":{},"from":"8.0","status":"changed","to":"8.1"},{"documentation_changed":true,"fields":{},"from":"8.1","status":"changed","to":"8.2"},{"documentation_changed":true,"fields":{},"from":"8.4","status":"changed","to":"9.0"},{"documentation_changed":false,"fields":{"category":{"from":"Connections and Authentication / Security and Authentication","to":"Connections and Authentication / Authentication"}},"from":"10","status":"changed","to":"11"},{"documentation_changed":true,"fields":{},"from":"11","status":"changed","to":"12"}],"content_hash":"af75a6e170eec0886b509024a1fd4e40940ca85ef3f4b2e5870a21186b372b1c","context":"","default_changed_in":[],"default_history":[{"from":"9.0","to":"19","value":"1 min"}],"derived_content_hash":"a331c39d3c6f33e3d9057d19e1adfe1edfddf0d13447954b11e40fdad0299bf0","editorial":{"advice":{"olap":"Apply the same security baseline to analytical access; isolate any legacy client exception to a dedicated role and a dated migration plan.","oltp":"Set authentication_timeout from the authentication architecture and security policy, not workload throughput. Test every driver, identity mapping, failover path, and credential-rotation procedure.","small":"Prefer the current secure default for authentication_timeout. Avoid weakening authentication to save marginal CPU on a small node; reduce connection churn with pooling instead."},"mechanism":["authentication_timeout sets the maximum allowed time to complete client authentication. The timer covers the authentication exchange before a normal backend session is established, limiting slots consumed by stalled or malicious handshakes.","authentication_timeout is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value.","The final authentication path combines this setting with pg_hba.conf, role attributes, credential material, client capabilities, and sometimes operating-system identity services."],"pitfalls":["Editing authentication_timeout without reloading configuration and verifying the effective value and subsequent behavior.","Changing one authentication setting without testing pg_hba.conf ordering, existing secrets, mappings, and every client library.","Weakening identity policy to solve connection churn or CPU cost that should be addressed with pooling and capacity planning.","Changing authentication_timeout globally without a rollback plan and a client or operational compatibility test."],"references":[{"title":"PostgreSQL 19 Beta 4: authentication_timeout","url":"https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-AUTHENTICATION-TIMEOUT"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["tcp_keepalives_idle","tcp_keepalives_interval","tcp_keepalives_count","tcp_user_timeout","client_connection_check_interval"],"summary":"authentication_timeout is the PostgreSQL setting that defines the maximum allowed time to complete client authentication."},"enumvals":[],"first_version":"7.4","group":"Connections and Authentication","group_slug":"connection","imported_at":"2026-09-27T17:57:30.77673+08:00","intro_commit":{},"key":"authentication_timeout","last_version":"20","max_val":"","min_val":"","name":"authentication_timeout","position":15,"present_in":["7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6","10","11","12","13","14","15","16","17","18","19","20"],"repair_provenance":{"original_source_revision":"english-manuals:1b3588bdfb92f6e45e02929642fc073c22f13c36bad11ccb7fb4a35703b06292","receipt_sha256":"d9c4497dad172f40395ad0b70f37488d077a748481c4cddc3ac39fad15ed0bab","repair":"wiki-repair-20261023"},"short_desc":"Maximum amount of time allowed to complete client authentication.","short_desc_zh":"","source_rev":"wiki-repair-20261023:40e485e9b056f9157cbb9e63a9ca77aacbd7710bc51f71accf7f298d11395bec","unit":"","vartype":"integer"}},"Definition":{"Collection":"guc","Key":"authentication_timeout","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"authentication_timeout","SourceRevision":"wiki-repair-20261023:40e485e9b056f9157cbb9e63a9ca77aacbd7710bc51f71accf7f298d11395bec","Facts":{"boot_val":"60","category":"Connections and Authentication / Authentication","context":"sighup","description":"Maximum amount of time allowed to complete client authentication. If a would-be client has not completed the authentication protocol in this much time, the server closes the connection. This prevents hung clients from occupying a connection indefinitely. If this value is specified without units, it is taken as seconds. The default is one minute (1m). This parameter can only be set in the postgresql.conf file or on the server command line.","description_zh":"允许完成客户端认证的最长时间。如果一个客户端没有在这段时间里完成认证协议，服务器将关闭连接。这样就避免了出问题的客户端无限制地占有一个连接。如果指定值时没有单位，则以秒为单位。默认值是 1 分钟（1m）。这个参数只能在服务器命令行上或者在 postgresql.conf 文件中设置。","description_zh_html":"\u003cp\u003e\n        允许完成客户端认证的最长时间。如果一个客户端没有在这段时间里完成认证协议，服务器将关闭连接。这样就避免了出问题的客户端无限制地占有一个连接。如果指定值时没有单位，则以秒为单位。默认值是 1 分钟（\u003ccode class=\"literal\"\u003e1m\u003c/code\u003e）。这个参数只能在服务器命令行上或者在 \u003ccode class=\"filename\"\u003epostgresql.conf\u003c/code\u003e 文件中设置。\n       \u003c/p\u003e","doc":{"anchor":"GUC-AUTHENTICATION-TIMEOUT","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"},"documented":true,"enumvals":null,"extra_desc":null,"lang":"en","max_val":"600","metadata_version":"18","min_val":"1","name":"authentication_timeout","short_desc":"Sets the maximum allowed time to complete client authentication.","source":"pg-settings-source-snapshot","translation_provenance":{"inputs":[{"kind":"current-pgdoc-translation","path":"/Users/vonng/pgsty/pgdoc/zh/18/html/runtime-config-connection.html","sha256":"f4e5e4debc927cfa154bbdd71f3bf2eda8130ac3acace1109fe7d45ef2a3456b"}],"kind":"same-version-pgdoc","locale":"zh-Hans","source_revision":"b1b500221dbe5437cfca004d6b04d3f6e422765d","version":"18"},"unit":"s","vartype":"integer","zh_from":"same-version-pgdoc"},"ManualEvidence":{"doc":{"anchor":"GUC-AUTHENTICATION-TIMEOUT","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"authentication_timeout","SourceDatabase":"center","Version":"18","Locale":"en","Title":"authentication_timeout","Summary":"Maximum amount of time allowed to complete client authentication. If a would-be client has not completed the authentication protocol in this much time, the server closes the connection. This prevents hung clients from occupying a connection indefinitely. If this value is specified without units, it is taken as seconds. The default is one minute (1m). This parameter can only be set in the postgresql.conf file or on the server command line.","BodyHTML":"\u003cp\u003eMaximum amount of time allowed to complete client authentication. If a would-be client has not completed the authentication protocol in this much time, the server closes the connection. This prevents hung clients from occupying a connection indefinitely. If this value is specified without units, it is taken as seconds. The default is one minute (1m). This parameter can only be set in the postgresql.conf file or on the server command line.\u003c/p\u003e","SourceRevision":"wiki-repair-20261023:40e485e9b056f9157cbb9e63a9ca77aacbd7710bc51f71accf7f298d11395bec","ContentHash":"133ec6bdfcdf3bb688b0506b25a7596e13ed283a79f7ee120679e5177576ec8d","Payload":{"description":"Maximum amount of time allowed to complete client authentication. If a would-be client has not completed the authentication protocol in this much time, the server closes the connection. This prevents hung clients from occupying a connection indefinitely. If this value is specified without units, it is taken as seconds. The default is one minute (1m). This parameter can only be set in the postgresql.conf file or on the server command line."}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20","7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}