{"record":{"id":"12cded2eb5c87931","repo":"XTLS/Xray-core","slug":"no-matching-auth-method","errorCode":null,"errorMessage":"no matching auth method","messagePattern":"no matching auth method","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":116,"sourceCode":"\t}\n}\n\nfunc (s *ServerSession) auth5(nMethod byte, reader io.Reader, writer io.Writer) (username string, err error) {\n\tbuffer := buf.StackNew()\n\tdefer buffer.Release()\n\n\tif _, err = buffer.ReadFullFrom(reader, int32(nMethod)); err != nil {\n\t\treturn \"\", errors.New(\"failed to read auth methods\").Base(err)\n\t}\n\n\tvar expectedAuth byte = authNotRequired\n\tif s.config.AuthType == AuthType_PASSWORD {\n\t\texpectedAuth = authPassword\n\t}\n\n\tif !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {\n\t\twriteSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)\n\t\treturn \"\", errors.New(\"no matching auth method\")\n\t}\n\n\tif err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {\n\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t}\n\n\tif expectedAuth == authPassword {\n\t\tusername, password, err := ReadUsernamePassword(reader)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.New(\"failed to read username and password for authentication\").Base(err)\n\t\t}\n\n\t\tif !s.config.HasAccount(username, password) {\n\t\t\twriteSocks5AuthenticationResponse(writer, 0x01, 0xFF)\n\t\t\treturn \"\", errors.New(\"invalid username or password\")\n\t\t}\n\n\t\tif err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L98-L134","documentation":"Thrown by auth5 (proxy/socks/protocol.go:116) when the client's offered SOCKS5 auth methods do not include the one the server demands: 0x02 (username/password) if AuthType_PASSWORD, or 0x00 (no-auth) otherwise. The server replies with 0xFF (no acceptable methods) and aborts negotiation.","triggerScenarios":"Server inbound has accounts (password auth) but the client offers only 0x00; or server has no auth while a client offers only exotic methods (GSSAPI, 0x02, etc.) without 0x00.","commonSituations":"Forgetting to configure credentials in the client app while the Xray inbound lists accounts; curl used without --user against an authenticated inbound; client libraries whose default method list excludes username/password.","solutions":["If the server requires auth: configure the client to offer method 0x02 and send the matching username/password (e.g. curl -x socks5h://user:pass@host:port).","If the server should be open: remove the accounts array / set auth_type to NO_AUTH in the inbound config.","Double-check credentials are actually being applied by the client (env vars like ALL_PROXY sometimes override without user info)."],"exampleFix":"# before: no credentials offered to a password-auth inbound\ncurl -x socks5h://127.0.0.1:1080 https://example.com\n\n# after: credentials supplied\ncurl -x socks5h://alice:secret@127.0.0.1:1080 https://example.com","handlingStrategy":"validation","validationCode":"// Client-side: offer both no-auth and username/password so any server config matches\nmethods := []byte{0x00, 0x02}\nconn.Write(append([]byte{0x05, byte(len(methods))}, methods...))\n// Server-side: ensure the accounts list matches the auth methods clients actually offer","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no matching auth method\") {\n    if serverRequiresAuth {\n        return dialWithCredentials(user, pass)\n    }\n    return err\n}","preventionTips":["Offer methods [0x00, 0x02] from clients to work with both auth modes.","Keep inbound auth_type and the accounts list consistent.","Automate config sync so credential or auth-mode drift is caught in CI."],"tags":["socks","socks5","authentication","config","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}