{"record":{"id":"13cfc318bf83b521","repo":"XTLS/Xray-core","slug":"failed-to-write-a-request-payload","errorCode":null,"errorMessage":"failed to write A request payload","messagePattern":"failed to write A request payload","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"proxy/shadowsocks/client.go","lineNumber":127,"sourceCode":"\t\t\tnewCancel()\n\t\t}\n\t}, sessionPolicy.Timeouts.ConnectionIdle)\n\n\tif newCtx != nil {\n\t\tctx = newCtx\n\t}\n\n\tif request.Command == protocol.RequestCommandTCP {\n\t\trequestDone := func() error {\n\t\t\tdefer timer.SetTimeout(sessionPolicy.Timeouts.DownlinkOnly)\n\t\t\tbufferedWriter := buf.NewBufferedWriter(buf.NewWriter(conn))\n\t\t\tbodyWriter, err := WriteTCPRequest(request, bufferedWriter)\n\t\t\tif err != nil {\n\t\t\t\treturn errors.New(\"failed to write request\").Base(err)\n\t\t\t}\n\n\t\t\tif err = buf.CopyOnceTimeout(link.Reader, bodyWriter, time.Millisecond*100); err != nil && err != buf.ErrNotTimeoutReader && err != buf.ErrReadTimeout {\n\t\t\t\treturn errors.New(\"failed to write A request payload\").Base(err).AtWarning()\n\t\t\t}\n\n\t\t\tif err := bufferedWriter.SetBuffered(false); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\treturn buf.Copy(link.Reader, bodyWriter, buf.UpdateActivity(timer))\n\t\t}\n\n\t\tresponseDone := func() error {\n\t\t\tdefer timer.SetTimeout(sessionPolicy.Timeouts.UplinkOnly)\n\n\t\t\tresponseReader, err := ReadTCPResponse(user, conn)\n\t\t\tif err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\n\t\t\treturn buf.Copy(responseReader, link.Writer, buf.UpdateActivity(timer))","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/shadowsocks/client.go#L109-L145","documentation":"Raised when the first-chunk probe copy (buf.CopyOnceTimeout with a 100ms budget) of the client's TCP payload fails with an error other than the two expected timeout conditions. It is marked AtWarning because a slow client that sends nothing within 100ms is normal; only a genuine write error (e.g. broken socket while relaying the first payload bytes) triggers it. The task then aborts the request direction.","triggerScenarios":"Dispatching a TCP request through the Shadowsocks client where link.Reader yields a first payload chunk but writing it through the AEAD body writer fails — connection reset by the remote server between the header write and the first payload write, or an encoder error inside the cipher stream.","commonSituations":"Server closes the socket immediately after a wrong password/cipher mismatch (AEAD decrypt failure on server causes instant close); middlebox RST on first data bytes; client application (browser) aborting the request within the first 100ms producing unexpected reader state.","solutions":["Verify password and cipher method match exactly between client outbound and server inbound — a mismatch makes the server drop the connection on first data.","Check server logs for AEAD authentication failures at the same timestamp.","Confirm no DPI/middlebox is resetting the stream (tcpdump on client host).","If the client app legitimately aborts instantly, this warning can be ignored; otherwise retest with curl through the proxy."],"exampleFix":"// before\n\"outbounds\": [{ \"protocol\": \"shadowsocks\", \"settings\": { \"servers\": [\n  { \"address\": \"srv\", \"port\": 8388, \"method\": \"aes-128-gcm\", \"password\": \"client-side-pass\" } ] } }]\n// after: align credentials with the server inbound\n{ \"address\": \"srv\", \"port\": 8388, \"method\": \"aes-128-gcm\", \"password\": \"server-side-pass\" }","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// warning-level: inspect base cause, usually safe to surface and close the link\nif err := requestDone(); err != nil && !errors.Is(err, buf.ErrReadTimeout) {\n  log.Warn(\"ss first payload write failed: \", err)\n}","preventionTips":["Keep cipher/password identical on both ends to avoid server-side AEAD reject-close.","Do not treat this warning alone as server failure; correlate with server logs.","Test with a deterministic client (curl) to separate app-abort noise from real resets."],"tags":["shadowsocks","network","tcp","first-payload","cipher-mismatch"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}