{"record":{"id":"0bd7c5119f534cb6","repo":"XTLS/Xray-core","slug":"authentication-rejected-s","errorCode":null,"errorMessage":"authentication rejected: %s","messagePattern":"authentication rejected: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"transport/internet/finalmask/xmc/client.go","lineNumber":203,"sourceCode":"\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto reader: %w\", err)\n\t}\n\n\tc.writer, err = newCryptoWriter(c.writer, sharedSecret)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"new crypto writer: %w\", err)\n\t}\n\n\tpkt, err = readPacket(c.reader)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read login finished: %w\", err)\n\t}\n\tif pkt.packetID == 0x00 {\n\t\tvar reason String\n\t\tif readErr := pkt.readFields(&reason); readErr != nil {\n\t\t\treturn fmt.Errorf(\"authentication rejected\")\n\t\t}\n\t\treturn fmt.Errorf(\"authentication rejected: %s\", reason)\n\t}\n\tif pkt.packetID != 0x02 {\n\t\treturn fmt.Errorf(\"bad login finished packet id: %d\", pkt.packetID)\n\t}\n\n\treceivedProfile, err := readLoginSuccess(pkt)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"read login finished fields: %w\", err)\n\t}\n\tif receivedProfile != selectedProfile {\n\t\treturn fmt.Errorf(\"login profile mismatch\")\n\t}\n\tloginAcknowledgedLength, err := writePacketWithLength(c.writer, 0x03)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"write login acknowledged: %w\", err)\n\t}\n\tif err = runPaddingSchedule(c.reader, c.writer, true, loginAcknowledgedLength, c.paddingSchedule); err != nil {\n\t\treturn fmt.Errorf(\"run startup padding: %w\", err)","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/transport/internet/finalmask/xmc/client.go#L185-L221","documentation":"The server sent packet ID 0x00 — the Login Disconnect — after encryption was enabled, and the reason string decoded successfully. This is the server explicitly rejecting the client's authentication: in this protocol the password travels inside the RSA-encrypted verify token (verifyToken||c.password), so a wrong pre-shared password is the dominant cause.","triggerScenarios":"First Read/Write on a WrapConnClient connection where Config.Password on the client differs from the server's password; the server decrypts the verify token, compares with ConstantTimeCompare (server.go:219), and disconnects with a reason that is surfaced verbatim in this message.","commonSituations":"Password typos, environment drift between staging/production configs, trailing newline in a file-sourced password, or rotating the secret on one side only.","solutions":["Set the identical Config.Password on both client and server (watch for trailing whitespace/newlines)","Re-deploy/restart both ends after rotating the password","If the reason text mentions profiles, also validate the configured username/UUID profiles"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"_, err := conn.Read(buf)\nif err != nil && strings.Contains(err.Error(), \"authentication rejected\") {\n    log.Error(\"server rejected auth\", \"reason\", err.Error())\n    return ErrCredentialMismatch // stop retrying; fix config\n}","preventionTips":["Store the password in a single shared secret source for both ends","Restart both endpoints after any password rotation","Trim whitespace when loading passwords from files/env"],"tags":["auth","password","handshake","go"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}