XTLS/Xray-core · error

no matching auth method

Error message

no matching auth method

What it means

Thrown by auth5 (proxy/socks/protocol.go:116) when the client's offered SOCKS5 auth methods do not include the one the server demands: 0x02 (username/password) if AuthType_PASSWORD, or 0x00 (no-auth) otherwise. The server replies with 0xFF (no acceptable methods) and aborts negotiation.

Source

Thrown at proxy/socks/protocol.go:116

	}
}

func (s *ServerSession) auth5(nMethod byte, reader io.Reader, writer io.Writer) (username string, err error) {
	buffer := buf.StackNew()
	defer buffer.Release()

	if _, err = buffer.ReadFullFrom(reader, int32(nMethod)); err != nil {
		return "", errors.New("failed to read auth methods").Base(err)
	}

	var expectedAuth byte = authNotRequired
	if s.config.AuthType == AuthType_PASSWORD {
		expectedAuth = authPassword
	}

	if !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {
		writeSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)
		return "", errors.New("no matching auth method")
	}

	if err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {
		return "", errors.New("failed to write auth response").Base(err)
	}

	if expectedAuth == authPassword {
		username, password, err := ReadUsernamePassword(reader)
		if err != nil {
			return "", errors.New("failed to read username and password for authentication").Base(err)
		}

		if !s.config.HasAccount(username, password) {
			writeSocks5AuthenticationResponse(writer, 0x01, 0xFF)
			return "", errors.New("invalid username or password")
		}

		if err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. If the server requires auth: configure the client to offer method 0x02 and send the matching username/password (e.g. curl -x socks5h://user:pass@host:port).
2. If the server should be open: remove the accounts array / set auth_type to NO_AUTH in the inbound config.
3. Double-check credentials are actually being applied by the client (env vars like ALL_PROXY sometimes override without user info).

Example fix

# before: no credentials offered to a password-auth inbound
curl -x socks5h://127.0.0.1:1080 https://example.com

# after: credentials supplied
curl -x socks5h://alice:secret@127.0.0.1:1080 https://example.com

// Client-side: offer both no-auth and username/password so any server config matches
methods := []byte{0x00, 0x02}
conn.Write(append([]byte{0x05, byte(len(methods))}, methods...))
// Server-side: ensure the accounts list matches the auth methods clients actually offer

if err != nil && strings.Contains(err.Error(), "no matching auth method") {
    if serverRequiresAuth {
        return dialWithCredentials(user, pass)
    }
    return err
}

When it happens

Trigger: Server inbound has accounts (password auth) but the client offers only 0x00; or server has no auth while a client offers only exotic methods (GSSAPI, 0x02, etc.) without 0x00.

Common situations: Forgetting to configure credentials in the client app while the Xray inbound lists accounts; curl used without --user against an authenticated inbound; client libraries whose default method list excludes username/password.

Related errors

• invalid username or password
• socks 4 is not allowed when auth is required.
• failed to read auth methods
• failed to read username and password for authentication
• UDP is not enabled.

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/12cded2eb5c87931. Report an issue: GitHub.