XTLS/Xray-core · error

socks 4 is not allowed when auth is required.

Error message

socks 4 is not allowed when auth is required.

What it means

Thrown by ServerSession.handshake4 (proxy/socks/protocol.go:55) when a client opens a SOCKS4/4a connection while the inbound is configured with AuthType_PASSWORD. SOCKS4 has no username/password sub-negotiation compatible with the server's account requirement, so the server immediately writes a socks4RequestRejected response and refuses the handshake.

Source

Thrown at proxy/socks/protocol.go:55

)

var addrParser = protocol.NewAddressParser(
	protocol.AddressFamilyByte(0x01, net.AddressFamilyIPv4),
	protocol.AddressFamilyByte(0x04, net.AddressFamilyIPv6),
	protocol.AddressFamilyByte(0x03, net.AddressFamilyDomain),
)

type ServerSession struct {
	config       *ServerConfig
	address      net.Address
	port         net.Port
	localAddress net.Address
}

func (s *ServerSession) handshake4(cmd byte, reader io.Reader, writer io.Writer) (*protocol.RequestHeader, error) {
	if s.config.AuthType == AuthType_PASSWORD {
		writeSocks4Response(writer, socks4RequestRejected, net.AnyIP, net.Port(0))
		return nil, errors.New("socks 4 is not allowed when auth is required.")
	}

	var port net.Port
	var address net.Address

	{
		buffer := buf.StackNew()
		if _, err := buffer.ReadFullFrom(reader, 6); err != nil {
			buffer.Release()
			return nil, errors.New("insufficient header").Base(err)
		}
		port = net.PortFromBytes(buffer.BytesRange(0, 2))
		address = net.IPAddress(buffer.BytesRange(2, 6))
		buffer.Release()
	}

	if _, err := ReadUntilNull(reader); /* user id */ err != nil {
		return nil, err

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Switch the client to SOCKS5 (curl --socks5-hostname, proxy settings 'SOCKS v5') and supply the configured username/password.
2. If SOCKS4 support is genuinely required, remove the accounts / set auth_type to NO_AUTH on that inbound (accepting that anyone can use it).
3. Expose a separate unauthenticated inbound on a protected interface for the legacy SOCKS4 client.

Example fix

# before: client uses SOCKS4 against an auth-required inbound
curl --socks4 127.0.0.1:1080 https://example.com

# after: client uses SOCKS5 with credentials
curl --socks5-hostname user:pass@127.0.0.1:1080 https://example.com

// Before connecting, verify compatibility: SOCKS4 requires an unauthenticated inbound
if clientVersion == 4 && serverConfigAuth == "password" {
    log.Fatal("SOCKS4 cannot be used against a password-authenticated inbound; use SOCKS5")
}

if err != nil && strings.Contains(err.Error(), "socks 4 is not allowed when auth is required") {
    // fall back to SOCKS5 with credentials
    return dialSocks5(user, pass)
}

When it happens

Trigger: Inbound socks server config has auth_type: PASSWORD (or accounts set) and a client connects with protocol version byte 0x04, e.g. curl --socks4, an old app hardcoded to SOCKS4, or a port-scanner probe.

Common situations: Mixing legacy SOCKS4 clients with an authenticated Xray inbound; forgetting that enabling accounts implicitly requires SOCKS5 username/password auth; a security scanner testing the exposed port.

Related errors

• failed to read auth methods
• no matching auth method
• invalid username or password
• unknown Socks version: {version}
• unknown config id:

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/51e851e9d9f623b5. Report an issue: GitHub.