{"record":{"id":"287b42c9e46fdc32","repo":"XTLS/Xray-core","slug":"failed-to-read-username-and-password-for-authentic","errorCode":null,"errorMessage":"failed to read username and password for authentication","messagePattern":"failed to read username and password for authentication","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":126,"sourceCode":"\n\tvar expectedAuth byte = authNotRequired\n\tif s.config.AuthType == AuthType_PASSWORD {\n\t\texpectedAuth = authPassword\n\t}\n\n\tif !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {\n\t\twriteSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)\n\t\treturn \"\", errors.New(\"no matching auth method\")\n\t}\n\n\tif err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {\n\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t}\n\n\tif expectedAuth == authPassword {\n\t\tusername, password, err := ReadUsernamePassword(reader)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.New(\"failed to read username and password for authentication\").Base(err)\n\t\t}\n\n\t\tif !s.config.HasAccount(username, password) {\n\t\t\twriteSocks5AuthenticationResponse(writer, 0x01, 0xFF)\n\t\t\treturn \"\", errors.New(\"invalid username or password\")\n\t\t}\n\n\t\tif err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {\n\t\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t\t}\n\t\treturn username, nil\n\t}\n\n\treturn \"\", nil\n}\n\nfunc (s *ServerSession) handshake5(nMethod byte, reader io.Reader, writer net.Conn) (*protocol.RequestHeader, *TempUDPConn, error) {\n\tvar (","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L108-L144","documentation":"Thrown in auth5 (proxy/socks/protocol.go:126) when ReadUsernamePassword fails parsing the RFC 1929 sub-negotiation message: 0x01, ULEN, username(ULEN), PLEN, password(PLEN). Any short read, bad length prefix, or connection drop during this message triggers it.","triggerScenarios":"Client offers method 0x02 but sends a malformed username/password message: wrong version byte handled by the reader, ULEN larger than the actual data, missing password section, or disconnect mid-message.","commonSituations":"Custom clients with wrong length encoding; usernames or passwords over 255 bytes (the 1-byte length field cannot represent them); connections cut during slow handshakes; proxy chains where an intermediate mangles the stream.","solutions":["Verify the client encodes RFC 1929 exactly: 0x01 | ULEN(1) | UNAME(ULEN) | PLEN(1) | PASSWD(PLEN), each length <= 255.","Shorten credentials to at most 255 bytes each; the protocol cannot carry longer ones.","Check the base error for EOF/reset to distinguish framing bugs from dropped connections."],"exampleFix":"// before: forgot PLEN/PASSWD section\nconn.Write([]byte{0x01, 0x05, 'a','l','i','c','e'})\n\n// after: full RFC1929 message, user=alice pass=secret\nconn.Write([]byte{0x01, 0x05, 'a','l','i','c','e', 0x06, 's','e','c','r','e','t'})","handlingStrategy":"validation","validationCode":"// Client-side: build a spec-compliant RFC 1929 message\nfunc rfc1929(user, pass string) ([]byte, error) {\n    if len(user) == 0 || len(user) > 255 || len(pass) > 255 {\n        return nil, fmt.Errorf(\"credentials exceed RFC1929 1-byte length limits\")\n    }\n    msg := []byte{0x01, byte(len(user))}\n    msg = append(msg, user...)\n    msg = append(msg, byte(len(pass)))\n    return append(msg, pass...), nil\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to read username and password\") {\n    return fmt.Errorf(\"malformed RFC1929 credentials message: %w\", err)\n}","preventionTips":["Cap usernames and passwords at 255 bytes each.","Write the whole credentials message in one call.","Unit-test client encoders against the RFC layout."],"tags":["socks","socks5","authentication","rfc1929","truncated-request","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}