ProxySQL Support for MySQL caching_sha2_passwordEvery day we use dozens if not hundreds of applications connecting to some kind of data repository. This simple step is normally executed over the network and, given so, it is subject to possible sniffing with all the possible related consequences.

Given that, it is normally better to protect your connection using data encryption like SSL, or at the minimum, make the information you pass to connect less easy to be intercepted.

At the same time, it is a best practice to not store connection credentials in clear text, not even inside a table in your database. Doing that is the equivalent of writing your password on a sticky note on your desk. Not a good idea.

Instead, the main options are either transforming the passwords to be less identifiable via hashing or storing the information in an external centralized vault.

In MySQL, the passwords are transformed to not be clear text, and several different plugins are used to authenticate the user. From version 8, MySQL uses caching_sha2_password as the default authentication plugin. The caching_sha2_password and sha256_password authentication plugins provide more secure password encryption than the mysql_native_password plugin, and caching_sha2_password provides better performance than sha256_password. Due to these superior security and performance characteristics of caching_sha2_password, it is the preferred authentication plugin as of MySQL 8.0 and is also the default authentication plugin rather than mysql_native_password.

In this regard, recently I got the same question again “Can we use ProxySQL with MySQL 8 authorization mechanism?”, and I decided it was time to write this short blog post.

The short answer is “Yes you can”, however, do not expect to have full caching_sha2_password support.

This is because ProxySQL does not fully support the caching_sha2_password mechanism internally and, given that, a “trick” must be used. 

So, what should we do when using MySQL 8 and ProxySQL? 

In the text below we will see what can be done to continue to use ProxySQL with MySQL and Percona Server for MySQL 8

Note that I have used the Percona proxysql_admin tool to manage the users except in the last case.
It is a nice tool that helps you to manage ProxySQL and in regards to a user, it also manages and synchronizes users from your Percona Server for MySQL or MySQL instance.  

In the following examples:

Proxysql is on

User name/password is msandbox/msandbox

Using hashing

By default, MySQL comes with caching_sha2_password and if I create the user name msandbox I will have:

Then I use percona_scheduler_admin to sync the users:

And set the query rules:

Now I try to connect, passing by ProxySQL:

My account will fail to connect given the failed authentication.

To fix this I need to drop the user and recreate it with a different authentication plugin in my MySQL server:

At this point, I can re-run:

And if I try to connect again:

This is the only way to keep the password hashed in MySQL and ProxySQL.

Not using hashing

What if you cannot use mysql_native_password for the password in your MySQL server?

There is a way to still connect, however, I do not recommend it as it is highly insecure, but for completeness, I am going to illustrate it.

First of all, disable password hashing in Proxysql:

At this point, instead, sync the user you can locally create the user like:

As you can see, doing that will prevent the password from being hashed, and instead, it will be clear text. 

At this point, you will be able to connect to MySQL 8 using the caching_sha2_password, but the password is visible in ProxySQL.

Let me repeat, I DO NOT recommend using it this way, because for me it is highly insecure. 


While it is still possible to configure your user in MySQL to connect using ProxySQL, it is obvious that we have a gap in the way ProxySQL supports security. 

The hope is that this gap will be filled soon by the ProxySQL development team. Also if you are looking at the past issues, this seems pending for years now. 


Upgrade your Libraries: Authentication Plugin ‘caching_sha2_password’ Cannot be Loaded

Notify of

Inline Feedbacks
View all comments