XTLS/Xray-core · error

Unknown security "" + c.Security + "".

Error message

Unknown security "" + c.Security + "".

What it means

Default-branch error from StreamConfig security building: streamSettings.security is not one of "", "none", "tls", "reality", or "xtls". Note "xtls" is separately rejected as a removed legacy feature, so any other string (including typos and legacy names like "realitys") lands here. The invalid value is interpolated into the message.

Source

Thrown at infra/conf/transport_internet.go:116

		config.SecurityType = tm.Type
	case "reality":
		if config.ProtocolName != "tcp" && config.ProtocolName != "splithttp" && config.ProtocolName != "grpc" {
			return nil, errors.New("REALITY only supports RAW, XHTTP and gRPC for now.")
		}
		if c.REALITYSettings == nil {
			return nil, errors.New(`REALITY: Empty "realitySettings".`)
		}
		ts, err := c.REALITYSettings.Build()
		if err != nil {
			return nil, errors.New("Failed to build REALITY config.").Base(err)
		}
		tm := serial.ToTypedMessage(ts)
		config.SecuritySettings = append(config.SecuritySettings, tm)
		config.SecurityType = tm.Type
	case "xtls":
		return nil, errors.PrintRemovedFeatureError(`Legacy XTLS`, `xtls-rprx-vision with TLS or REALITY`)
	default:
		return nil, errors.New(`Unknown security "` + c.Security + `".`)
	}

	if c.RAWSettings != nil {
		c.TCPSettings = c.RAWSettings
	}
	if c.TCPSettings != nil {
		ts, err := c.TCPSettings.Build()
		if err != nil {
			return nil, errors.New("Failed to build RAW config.").Base(err)
		}
		config.TransportSettings = append(config.TransportSettings, &internet.TransportConfig{
			ProtocolName: "tcp",
			Settings:     serial.ToTypedMessage(ts),
		})
	}
	if c.XHTTPSettings != nil {
		c.SplitHTTPSettings = c.XHTTPSettings
	}

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Set security to one of: "none", "tls", or "reality".
2. For legacy "xtls", migrate to "tls"/"reality" with xtls-rprx-vision flow.
3. Remove the security field entirely if no security layer is wanted (defaults to none).

Example fix

// before
"security": "ssl"
// after
"security": "tls"

switch strings.ToLower(security) {
case "", "none", "tls", "reality":
default:
    return fmt.Errorf("unsupported security %q (xtls is removed; use tls or reality)", security)
}

When it happens

Trigger: Setting security to "ssl", "TLS" (case not normalized), "auto", or "reality+tls" triggers this at build time.

Common situations: Typos; migrating configs from other clients that use different security names; leftover "xtls" values that now map to a removal error rather than working.

Related errors

• bridge tag is empty
• bridge domain is empty
• portal tag is empty
• portal domain is empty
• unknown action: {}

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/d284697d074ed901. Report an issue: GitHub.