XTLS/Xray-core · error

VLESS users: "encryption" should not be in inbound settings

Error message

VLESS users: "encryption" should not be in inbound settings

What it means

VLESS inbound users must not carry an 'encryption' field. Encryption is an outbound/client-side concept; in inbound settings its presence is rejected so the account cannot sneak an encryption mode into the server config.

Source

Thrown at infra/conf/vless.go:85

		if err != nil {
			return err
		}
		account.Id = u.String()

		switch account.Flow {
		case "":
			account.Flow = c.Flow
		case vless.XRV:
		default:
			return errors.New(`VLESS users: "flow" doesn't support "` + account.Flow + `" in this version`)
		}

		if len(account.Testseed) < 4 {
			account.Testseed = c.Testseed
		}

		if account.Encryption != "" {
			return errors.New(`VLESS users: "encryption" should not be in inbound settings`)
		}

		if account.Reverse != nil {
			if account.Reverse.Tag == "" {
				return errors.New(`VLESS users: "tag" can't be empty for "reverse"`)
			}
			if account.Reverse.Sniffing != nil { // may not be reached: error json unmarshal
				return errors.New(`VLESS users: inbound's "reverse" can't have "sniffing"`)
			}
		}

		user.Account = serial.ToTypedMessage(account)
		config.Users[idx] = user
		return nil
	}

	if err := task.ParallelForN(len(c.Users), processClient); err != nil {
		return nil, err

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Delete the "encryption" key from every client object in inbound settings
2. Keep "encryption": "none" only in the VLESS outbound settings on the client side

Example fix

// before
{ "id": "8c1f...", "encryption": "none" }
// after
{ "id": "8c1f..." }

if gjson.Get(clientRaw, "encryption").Exists() {
    return errors.New("client objects in inbound settings must not contain \"encryption\"")
}

When it happens

Trigger: A clients entry containing "encryption": "none" (or any value) inside the inbound's settings.clients array.

Common situations: Copying a full client JSON (including outbound-style fields) into the server's clients list — the outbound snippet's "encryption": "none" triggers it.

Related errors

• VLESS fallbacks: "path" must be empty or start with "/"
• VLESS fallbacks: please fill in a valid value for every "des
• VLESS fallbacks: invalid PROXY protocol version, "xver" only
• VLESS reverse: "tag" can't be empty
• VLESS reverse: invalid "sniffing" config

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/88b61a7e07b5851c. Report an issue: GitHub.