XTLS/Xray-core · error

failed to write auth response

Error message

failed to write auth response

What it means

Thrown in auth5 (proxy/socks/protocol.go:120) when writing the SOCKS5 method-selection reply (VER 0x05 + selected method) to the client fails. The protocol logic is fine; the underlying net.Conn write returned an error (broken pipe, connection reset, closed socket).

Source

Thrown at proxy/socks/protocol.go:120

	buffer := buf.StackNew()
	defer buffer.Release()

	if _, err = buffer.ReadFullFrom(reader, int32(nMethod)); err != nil {
		return "", errors.New("failed to read auth methods").Base(err)
	}

	var expectedAuth byte = authNotRequired
	if s.config.AuthType == AuthType_PASSWORD {
		expectedAuth = authPassword
	}

	if !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {
		writeSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)
		return "", errors.New("no matching auth method")
	}

	if err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {
		return "", errors.New("failed to write auth response").Base(err)
	}

	if expectedAuth == authPassword {
		username, password, err := ReadUsernamePassword(reader)
		if err != nil {
			return "", errors.New("failed to read username and password for authentication").Base(err)
		}

		if !s.config.HasAccount(username, password) {
			writeSocks5AuthenticationResponse(writer, 0x01, 0xFF)
			return "", errors.New("invalid username or password")
		}

		if err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {
			return "", errors.New("failed to write auth response").Base(err)
		}
		return username, nil
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Check the base error: EPIPE/ECONNRESET means the peer went away — usually harmless noise from probes or flaky clients.
2. If frequent, verify the handshake timeout policy is not too small (policy timeouts 'handshake').
3. Ensure no firewall/middlebox between client and server injects RSTs on the SOCKS port.

if err != nil && strings.Contains(err.Error(), "failed to write auth response") {
    // peer disconnected during negotiation; nothing to salvage
    return nil // or log at debug level and drop the connection
}

When it happens

Trigger: The client disconnects immediately after sending its method list (fire-and-forget probe); the TCP connection is reset by a middlebox or NAT; the writer (net.Conn) was closed concurrently by a timeout handler.

Common situations: Scanners that open, write, and close; mobile/flaky networks dropping the session mid-handshake; aggressive handshake timeouts on the server side closing the conn during negotiation.

Related errors

• failed to read request
• connection ends
• insufficient header
• failed to read auth methods
• no matching auth method

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/a2599896eb2a2170. Report an issue: GitHub.