XTLS/Xray-core · error

authentication rejected: %s

Error message

authentication rejected: %s

What it means

The server sent packet ID 0x00 — the Login Disconnect — after encryption was enabled, and the reason string decoded successfully. This is the server explicitly rejecting the client's authentication: in this protocol the password travels inside the RSA-encrypted verify token (verifyToken||c.password), so a wrong pre-shared password is the dominant cause.

Source

Thrown at transport/internet/finalmask/xmc/client.go:203

	if err != nil {
		return fmt.Errorf("new crypto reader: %w", err)
	}

	c.writer, err = newCryptoWriter(c.writer, sharedSecret)
	if err != nil {
		return fmt.Errorf("new crypto writer: %w", err)
	}

	pkt, err = readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read login finished: %w", err)
	}
	if pkt.packetID == 0x00 {
		var reason String
		if readErr := pkt.readFields(&reason); readErr != nil {
			return fmt.Errorf("authentication rejected")
		}
		return fmt.Errorf("authentication rejected: %s", reason)
	}
	if pkt.packetID != 0x02 {
		return fmt.Errorf("bad login finished packet id: %d", pkt.packetID)
	}

	receivedProfile, err := readLoginSuccess(pkt)
	if err != nil {
		return fmt.Errorf("read login finished fields: %w", err)
	}
	if receivedProfile != selectedProfile {
		return fmt.Errorf("login profile mismatch")
	}
	loginAcknowledgedLength, err := writePacketWithLength(c.writer, 0x03)
	if err != nil {
		return fmt.Errorf("write login acknowledged: %w", err)
	}
	if err = runPaddingSchedule(c.reader, c.writer, true, loginAcknowledgedLength, c.paddingSchedule); err != nil {
		return fmt.Errorf("run startup padding: %w", err)

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Set the identical Config.Password on both client and server (watch for trailing whitespace/newlines)
2. Re-deploy/restart both ends after rotating the password
3. If the reason text mentions profiles, also validate the configured username/UUID profiles

_, err := conn.Read(buf)
if err != nil && strings.Contains(err.Error(), "authentication rejected") {
    log.Error("server rejected auth", "reason", err.Error())
    return ErrCredentialMismatch // stop retrying; fix config
}

When it happens

Trigger: First Read/Write on a WrapConnClient connection where Config.Password on the client differs from the server's password; the server decrypts the verify token, compares with ConstantTimeCompare (server.go:219), and disconnects with a reason that is surfaced verbatim in this message.

Common situations: Password typos, environment drift between staging/production configs, trailing newline in a file-sourced password, or rotating the secret on one side only.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authentication rejected
• read login finished: %w
• encrypt verify token: %w
• write encryption response: %w
• bad login finished packet id: %d

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/0bd7c5119f534cb6. Report an issue: GitHub.