XTLS/Xray-core · error

failed to parse HTTP account

Error message

failed to parse HTTP account

What it means

Thrown when json.Unmarshal of a users entry into HTTPAccount fails. After parsing the protocol.User envelope, Xray unmarshals the same JSON object into HTTPAccount (username/password fields); if those fields have wrong types (e.g. username as a number) or the JSON is malformed, this error is returned with the parse error attached. Only hit on the servers[].users form.

Source

Thrown at infra/conf/http.go:109

			Port:    uint32(serverConfig.Port),
		}
		for _, rawUser := range serverConfig.Users {
			user := new(protocol.User)
			if v.Address != nil {
				user.Level = v.Level
				user.Email = v.Email
			} else {
				if err := json.Unmarshal(rawUser, user); err != nil {
					return nil, errors.New("failed to parse HTTP user").Base(err).AtError()
				}
			}
			account := new(HTTPAccount)
			if v.Address != nil {
				account.Username = v.Username
				account.Password = v.Password
			} else {
				if err := json.Unmarshal(rawUser, account); err != nil {
					return nil, errors.New("failed to parse HTTP account").Base(err).AtError()
				}
			}
			user.Account = serial.ToTypedMessage(account.Build())
			server.User = user
			break
		}
		config.Server = server
		break
	}
	config.Header = make([]*http.Header, 0, 32)
	for key, value := range v.Headers {
		config.Header = append(config.Header, &http.Header{
			Key:   key,
			Value: value,
		})
	}
	return config, nil
}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Ensure username and password in each users entry are JSON strings
2. Use the documented field names for HTTP outbound users
3. Validate the raw JSON with jq before starting Xray

Example fix

// before
"users": [ { "user": 123, "pass": "x" } ]
// after
"users": [ { "user": "123", "pass": "x" } ]

var probe struct {
	Username string `json:"user"`
	Password string `json:"pass"`
}
if err := json.Unmarshal(rawUser, &probe); err != nil {
	return fmt.Errorf("HTTP account fields must be strings: %w", err)
}

When it happens

Trigger: A users entry like {"user": 123} where the username field is numeric, or extra structure that breaks deserialization of username/password into strings.

Common situations: Using key names from other ecosystems (e.g. "user" vs expected account field names) combined with wrong value types; templating bugs injecting non-string credentials.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• failed to parse HTTP user
• HTTP servers: "users" should have one member at most. Multip
• failed to decode config:
• illegal ip rule:
• illegal domain rule:

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/c7148387d603858a. Report an issue: GitHub.