Secure psql sessions
Command-line database access
Neon · Const
SCRAM authentication
Neon supports SCRAM-SHA-256-PLUS through channel_binding=require. It binds mutual authentication to the TLS channel, helping protect connections from man-in-the-middle attacks.
How it works
Neon uses SCRAM-SHA-256-PLUS when channel_binding=require is set. The client and server mutually authenticate over the TLS channel, binding authentication to the connection and helping prevent man-in-the-middle attacks. Keep this parameter alongside a secure sslmode setting when the client supports channel binding.
Syntax
postgresql://[user]:[password]@[neon_hostname]/[dbname]?sslmode=verify-full&channel_binding=requireParameters
| Name | Type | Description |
|---|---|---|
channel_binding | connection-string parameter | Requires SCRAM-SHA-256-PLUS channel binding for the connection. |
sslmode | connection-string parameter | Controls TLS requirements and certificate verification. |
Returns
A securely authenticated PostgreSQL connection; this is a connection option rather than a function.
Key points
- Use
channel_binding=requireto require channel binding during authentication. - The channel-binding mechanism used by Neon is SCRAM-SHA-256-PLUS.
- Binding authentication to the connection helps protect credentials and sessions from man-in-the-middle interception.
Common mistakes
- Retain
channel_binding=requirewithsslmode=requireunless the client cannot perform channel binding. - For strongest certificate validation, prefer
sslmode=verify-fullrather than relying only onsslmode=require.
Example: Secure psql connection
psql "postgresql://USER:PASSWORD@HOST/DATABASE?sslmode=verify-full&channel_binding=require"Connects with certificate verification and SCRAM channel binding enabled.
When to use it
Require channel binding in connection URLs
Application database connections
Combine channel binding with full certificate verification
High-assurance production connectivity
Interview questions
QWhat is SCRAM-SHA-256-PLUS in Neon?
SCRAM-SHA-256-PLUS is SCRAM authentication with channel binding. It mutually authenticates the client and server using the TLS channel, which helps defend against man-in-the-middle attacks.
Follow-up: What does channel binding add to ordinary SCRAM? It binds the authentication exchange to the certificate hash for the protected connection, so an intercepted or impersonated TLS channel cannot be used independently.
QHow do you enable SCRAM channel binding?
Set channel_binding=require in the connection string. A typical secure connection also uses sslmode=verify-full, which validates the server certificate and provides stronger protection than accepting any certificate.
Follow-up: How should a client behave if it lacks channel-binding support? Omit channel_binding=require only when necessary, while retaining the strongest SSL mode the client supports.
QHow do sslmode and channel binding differ?
sslmode=require encrypts the connection but does not validate the server certificate. sslmode=verify-full validates the certificate and hostname, while channel_binding=require adds mutual authentication tied to the secure channel.
Follow-up: Why are both settings useful? Certificate verification authenticates the endpoint, and channel binding links password authentication to that verified TLS connection.
Related
sslmodeverify-caverify-fullSCRAM-SHA-256-PLUSPGSSLROOTCERTpsql