XTLS/Xray-core · error

please fill in a valid value for "target"

Error message

please fill in a valid value for "target"

What it means

Thrown by the REALITY security settings builder when the 'target'/'dest' field cannot be interpreted as a valid destination. The builder normalizes the value: a leading 'https://' gets port 443, a bare number gets 'localhost:' prefixed, and any host:port that survives net.SplitHostPort becomes type tcp; a unix socket path starting with '@' or '/' becomes unix. If after all this c.Type is still empty, the target was unparseable.

Source

Thrown at infra/conf/transport_security.go:89

			switch s[0] {
			case '@', '/':
				c.Type = "unix"
				if s[0] == '@' && len(s) > 1 && s[1] == '@' && (runtime.GOOS == "linux" || runtime.GOOS == "android") {
					fullAddr := make([]byte, len(syscall.RawSockaddrUnix{}.Path)) // may need padding to work with haproxy
					copy(fullAddr, s[1:])
					s = string(fullAddr)
				}
			default:
				if _, err = strconv.Atoi(s); err == nil {
					s = "localhost:" + s
				}
				if _, _, err = net.SplitHostPort(s); err == nil {
					c.Type = "tcp"
				}
			}
		}
		if c.Type == "" {
			return nil, errors.New(`please fill in a valid value for "target"`)
		}
		if c.Xver > 2 {
			return nil, errors.New(`invalid PROXY protocol version, "xver" only accepts 0, 1, 2`)
		}
		if len(c.ServerNames) == 0 {
			return nil, errors.New(`empty "serverNames"`)
		}
		if c.PrivateKey == "" {
			return nil, errors.New(`empty "privateKey"`)
		}
		if config.PrivateKey, err = base64.RawURLEncoding.DecodeString(c.PrivateKey); err != nil || len(config.PrivateKey) != 32 {
			return nil, errors.New(`invalid "privateKey": `, c.PrivateKey)
		}
		if c.MinClientVer != "" {
			config.MinClientVer = make([]byte, 3)
			var u uint64
			for i, s := range strings.Split(c.MinClientVer, ".") {
				if i == 3 {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Use the documented forms: "https://example.com", "example.com:443", "127.0.0.1:8080", "localhost:8080", or a unix path "/var/run/x.sock" / abstract socket "@x".
2. Check the field is spelled exactly "target"/"dest" in your JSON.
3. Ensure a port is present when using the raw host:port form.

Example fix

// before
"realitySettings": { "target": "www.microsoft.com" }
// after
"realitySettings": { "target": "www.microsoft.com:443" }

func validRealityTarget(t string) bool {
    if t == "" { return false }
    if strings.HasPrefix(t, "@") || strings.HasPrefix(t, "/") { return true }
    if strings.HasPrefix(t, "https://") { return true }
    if n, err := strconv.Atoi(t); err == nil && n >= 0 { return true }
    _, _, err := net.SplitHostPort(t)
    return err == nil
}

When it happens

Trigger: Setting realitySettings.target to something like "example.com" without a port and not matching any accepted form, an empty string, or malformed values such as "https://" alone.

Common situations: First-time REALITY setups where target is copied without the port (e.g. "www.microsoft.com" instead of "www.microsoft.com:443" or "https://www.microsoft.com"), or the field name typo'd so it reads as empty.

Related errors

• REALITY only supports RAW, XHTTP and gRPC for now.
• REALITY: Empty "realitySettings".
• Unknown security "" + c.Security + "".
• both file and bytes are empty.
• invalid PROXY protocol version, "xver" only accepts 0, 1, 2

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/36bbda1faa594c0f. Report an issue: GitHub.