XTLS/Xray-core · error

sessionIDLength.from must be greater than 0

Error message

sessionIDLength.from must be greater than 0

What it means

Inside the sessionIDTable block, after the entropy check, SplitHTTPConfig.Build() requires sessionIDLength.From > 0 at transport_method.go:417-419. Zero-length session IDs cannot be generated from a table, so from must be at least 1. Note the ordering: the entropy check (error 413) runs first, so a zero range usually surfaces as 413 unless the table is large enough that even degenerate terms pass.

Source

Thrown at infra/conf/transport_method.go:418

		switch c.SessionIDPlacement {
		case "cookie", "query":
			c.SessionIDKey = "x_session"
		case "header":
			c.SessionIDKey = "X-Session"
		}
	}

	if c.SessionIDTable != "" {
		if predefined, ok := splithttp.PredefinedTable[c.SessionIDTable]; ok {
			c.SessionIDTable = predefined
		}
		room := roomSize(len(c.SessionIDTable), c.SessionIDLength.From, c.SessionIDLength.To)
		// 2.1B possiblities should be enough
		if room.Cmp(big.NewInt(2<<30)) < 0 {
			return nil, errors.New("sessionIDTable or sessionIDLength is too small")
		}
		if c.SessionIDLength.From <= 0 {
			return nil, errors.New("sessionIDLength.from must be greater than 0")
		}
		for i := 0; i < len(c.SessionIDTable); i++ {
			if c.SessionIDTable[i] >= 0x80 {
				return nil, errors.New("sessionIDTable must contain only ASCII characters")
			}
		}
	}

	if c.SeqPlacement != "path" && c.SeqKey == "" {
		switch c.SeqPlacement {
		case "cookie", "query":
			c.SeqKey = "x_seq"
		case "header":
			c.SeqKey = "X-Seq"
		}
	}

	if c.UplinkDataPlacement != splithttp.PlacementBody && c.UplinkDataKey == "" {

View on GitHub (pinned to 7d214f8b09)

Solutions

  1. Set "sessionIDLength": {"from": 1, ...} or higher (and keep the entropy rule satisfied)
  2. Remember from is the minimum generated ID length — it must be >= 1

Example fix

// before
"sessionIDTable": "abcdef", "sessionIDLength": { "from": 0, "to": 0 }
// after
"sessionIDTable": "abcdef", "sessionIDLength": { "from": 12, "to": 16 }
Defensive patterns

Strategy: validation

Validate before calling

// Go: from must be positive when a table is set
if cfg.SessionIDTable != "" && cfg.SessionIDLength.From <= 0 {
	return errors.New("set sessionIDLength.from >= 1")
}

Prevention

When it happens

Trigger: "sessionIDTable": <table> with "sessionIDLength": {"from": 0, "to": 5} or the field omitted (zero-value Int32Range has From=0) while a table is set and the room check happens to pass.

Common situations: Setting sessionIDTable without knowing sessionIDLength is required alongside; explicitly zeroing from intending 'auto'.

Related errors


AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6101177d262807f9. Report an issue: GitHub.