XTLS/Xray-core · error

authentication rejected

Error message

authentication rejected

What it means

After encryption was established, the server sent packet ID 0x00 (Login Disconnect / authentication rejected), but the client additionally failed to decode the reason string from that packet's fields (readFields on a String failed — malformed varint length or truncated body). The error deliberately hides the parse detail; the real event is that the server rejected authentication.

Source

Thrown at transport/internet/finalmask/xmc/client.go:201

	// Enable encryption
	c.reader, err = newCryptoReader(c.reader, sharedSecret)
	if err != nil {
		return fmt.Errorf("new crypto reader: %w", err)
	}

	c.writer, err = newCryptoWriter(c.writer, sharedSecret)
	if err != nil {
		return fmt.Errorf("new crypto writer: %w", err)
	}

	pkt, err = readPacket(c.reader)
	if err != nil {
		return fmt.Errorf("read login finished: %w", err)
	}
	if pkt.packetID == 0x00 {
		var reason String
		if readErr := pkt.readFields(&reason); readErr != nil {
			return fmt.Errorf("authentication rejected")
		}
		return fmt.Errorf("authentication rejected: %s", reason)
	}
	if pkt.packetID != 0x02 {
		return fmt.Errorf("bad login finished packet id: %d", pkt.packetID)
	}

	receivedProfile, err := readLoginSuccess(pkt)
	if err != nil {
		return fmt.Errorf("read login finished fields: %w", err)
	}
	if receivedProfile != selectedProfile {
		return fmt.Errorf("login profile mismatch")
	}
	loginAcknowledgedLength, err := writePacketWithLength(c.writer, 0x03)
	if err != nil {
		return fmt.Errorf("write login acknowledged: %w", err)
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Treat it exactly like 'authentication rejected': verify the shared password between client and server
2. Check the server's xmc implementation/version to see what reason payload it sends on 0x00
3. Capture the packet if the reason matters — the client discards it in this branch
4. Ensure profiles (username/UUID) are valid and accepted by the server

_, err := conn.Read(buf)
if err != nil && strings.Contains(err.Error(), "authentication rejected") {
    return fmt.Errorf("xmc auth failed (password mismatch?): verify shared secret config")
}

When it happens

Trigger: First Read/Write on the wrapped conn: server replies 0x00 with a malformed or empty reason payload (e.g. empty body after the packet ID, or non-UTF8/oversized length prefix), so pkt.readFields(&reason) errors and the client returns the bare 'authentication rejected'.

Common situations: Password mismatch where the server's disconnect reason is a Chat component the simple String reader cannot parse; a server version that formats the reason differently; or truncation by a middlebox.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• authentication rejected: %s
• read login finished: %w
• bad login finished packet id: %d
• read login finished fields: %w
• empty domain name

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/ca0ed60ac42be663. Report an issue: GitHub.