{"record":{"id":"2c8cf147623d0bc2","repo":"XTLS/Xray-core","slug":"reality-only-supports-raw-xhttp-and-grpc-for-now","errorCode":null,"errorMessage":"REALITY only supports RAW, XHTTP and gRPC for now.","messagePattern":"REALITY only supports RAW, XHTTP and gRPC for now\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_internet.go","lineNumber":101,"sourceCode":"\t}\n\n\tswitch strings.ToLower(c.Security) {\n\tcase \"\", \"none\":\n\tcase \"tls\":\n\t\ttlsSettings := c.TLSSettings\n\t\tif tlsSettings == nil {\n\t\t\ttlsSettings = &TLSConfig{}\n\t\t}\n\t\tts, err := tlsSettings.Build()\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"Failed to build TLS config.\").Base(err)\n\t\t}\n\t\ttm := serial.ToTypedMessage(ts)\n\t\tconfig.SecuritySettings = append(config.SecuritySettings, tm)\n\t\tconfig.SecurityType = tm.Type\n\tcase \"reality\":\n\t\tif config.ProtocolName != \"tcp\" && config.ProtocolName != \"splithttp\" && config.ProtocolName != \"grpc\" {\n\t\t\treturn nil, errors.New(\"REALITY only supports RAW, XHTTP and gRPC for now.\")\n\t\t}\n\t\tif c.REALITYSettings == nil {\n\t\t\treturn nil, errors.New(`REALITY: Empty \"realitySettings\".`)\n\t\t}\n\t\tts, err := c.REALITYSettings.Build()\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"Failed to build REALITY config.\").Base(err)\n\t\t}\n\t\ttm := serial.ToTypedMessage(ts)\n\t\tconfig.SecuritySettings = append(config.SecuritySettings, tm)\n\t\tconfig.SecurityType = tm.Type\n\tcase \"xtls\":\n\t\treturn nil, errors.PrintRemovedFeatureError(`Legacy XTLS`, `xtls-rprx-vision with TLS or REALITY`)\n\tdefault:\n\t\treturn nil, errors.New(`Unknown security \"` + c.Security + `\".`)\n\t}\n\n\tif c.RAWSettings != nil {","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_internet.go#L83-L119","documentation":"Thrown by StreamConfig security building when security is \"reality\" but the chosen transport is not tcp, splithttp (XHTTP), or grpc. REALITY hijacks the TLS handshake so it can only run over those three transports; websocket/mkcp/httpupgrade/domainsocket are rejected up front.","triggerScenarios":"Combining \"security\": \"reality\" with \"network\": \"websocket\" (or mkcp/httpupgrade) in streamSettings triggers this immediately at config build.","commonSituations":"Copy-pasting REALITY server examples onto a websocket-based proxy chain; migrating a vless+ws setup to REALITY without changing the network.","solutions":["Change the transport to tcp (RAW), splithttp (XHTTP), or grpc.","Or switch security back to \"tls\"/\"none\" if you must keep websocket/mkcp.","Align both sides (client and server) on the same transport+security pair."],"exampleFix":"// before\n\"network\": \"websocket\", \"security\": \"reality\"\n// after\n\"network\": \"tcp\", \"security\": \"reality\"","handlingStrategy":"validation","validationCode":"if strings.EqualFold(security, \"reality\") {\n    switch strings.ToLower(network) {\n    case \"tcp\", \"raw\", \"splithttp\", \"xhttp\", \"grpc\":\n    default:\n        return fmt.Errorf(\"reality requires tcp/xhttp/grpc, got %q\", network)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair reality only with tcp, splithttp, or grpc in templates.","Add a lint rule rejecting security=reality plus websocket/mkcp.","Keep client and server streamSettings mirrored."],"tags":["go","xray","config","reality","tls","transport"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}