XTLS/Xray-core · error

REALITY only supports RAW, XHTTP and gRPC for now.

Error message

REALITY only supports RAW, XHTTP and gRPC for now.

What it means

Thrown by StreamConfig security building when security is "reality" but the chosen transport is not tcp, splithttp (XHTTP), or grpc. REALITY hijacks the TLS handshake so it can only run over those three transports; websocket/mkcp/httpupgrade/domainsocket are rejected up front.

Source

Thrown at infra/conf/transport_internet.go:101

	}

	switch strings.ToLower(c.Security) {
	case "", "none":
	case "tls":
		tlsSettings := c.TLSSettings
		if tlsSettings == nil {
			tlsSettings = &TLSConfig{}
		}
		ts, err := tlsSettings.Build()
		if err != nil {
			return nil, errors.New("Failed to build TLS config.").Base(err)
		}
		tm := serial.ToTypedMessage(ts)
		config.SecuritySettings = append(config.SecuritySettings, tm)
		config.SecurityType = tm.Type
	case "reality":
		if config.ProtocolName != "tcp" && config.ProtocolName != "splithttp" && config.ProtocolName != "grpc" {
			return nil, errors.New("REALITY only supports RAW, XHTTP and gRPC for now.")
		}
		if c.REALITYSettings == nil {
			return nil, errors.New(`REALITY: Empty "realitySettings".`)
		}
		ts, err := c.REALITYSettings.Build()
		if err != nil {
			return nil, errors.New("Failed to build REALITY config.").Base(err)
		}
		tm := serial.ToTypedMessage(ts)
		config.SecuritySettings = append(config.SecuritySettings, tm)
		config.SecurityType = tm.Type
	case "xtls":
		return nil, errors.PrintRemovedFeatureError(`Legacy XTLS`, `xtls-rprx-vision with TLS or REALITY`)
	default:
		return nil, errors.New(`Unknown security "` + c.Security + `".`)
	}

	if c.RAWSettings != nil {

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Change the transport to tcp (RAW), splithttp (XHTTP), or grpc.
2. Or switch security back to "tls"/"none" if you must keep websocket/mkcp.
3. Align both sides (client and server) on the same transport+security pair.

Example fix

// before
"network": "websocket", "security": "reality"
// after
"network": "tcp", "security": "reality"

if strings.EqualFold(security, "reality") {
    switch strings.ToLower(network) {
    case "tcp", "raw", "splithttp", "xhttp", "grpc":
    default:
        return fmt.Errorf("reality requires tcp/xhttp/grpc, got %q", network)
    }
}

When it happens

Trigger: Combining "security": "reality" with "network": "websocket" (or mkcp/httpupgrade) in streamSettings triggers this immediately at config build.

Common situations: Copy-pasting REALITY server examples onto a websocket-based proxy chain; migrating a vless+ws setup to REALITY without changing the network.

Related errors

• unknown type
• gecko: invalid min/max packet size
• invalid scheme + u.Scheme
• empty stunServers
• Config: unknown transport protocol: + p

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/2c8cf147623d0bc2. Report an issue: GitHub.