{"record":{"id":"435cfe1a9690f3a4","repo":"XTLS/Xray-core","slug":"failed-to-get-shadowsocks-user","errorCode":null,"errorMessage":"failed to get shadowsocks user","messagePattern":"failed to get shadowsocks user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/shadowsocks/server.go","lineNumber":37,"sourceCode":"\t\"github.com/xtls/xray-core/features/routing\"\n\t\"github.com/xtls/xray-core/transport/internet/stat\"\n\t\"github.com/xtls/xray-core/transport/internet/udp\"\n)\n\ntype Server struct {\n\tconfig        *ServerConfig\n\tvalidator     *Validator\n\tpolicyManager policy.Manager\n\tcone          bool\n}\n\n// NewServer create a new Shadowsocks server.\nfunc NewServer(ctx context.Context, config *ServerConfig) (*Server, error) {\n\tvalidator := new(Validator)\n\tfor _, user := range config.Users {\n\t\tu, err := user.ToMemoryUser()\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"failed to get shadowsocks user\").Base(err).AtError()\n\t\t}\n\n\t\tif err := validator.Add(u); err != nil {\n\t\t\treturn nil, errors.New(\"failed to add user\").Base(err).AtError()\n\t\t}\n\t}\n\n\tv := core.MustFromContext(ctx)\n\ts := &Server{\n\t\tconfig:        config,\n\t\tvalidator:     validator,\n\t\tpolicyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),\n\t\tcone:          ctx.Value(\"cone\").(bool),\n\t}\n\n\treturn s, nil\n}\n","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/shadowsocks/server.go#L19-L55","documentation":"Server-startup error: while converting each configured user via ToMemoryUser() one failed, and this wrapper (AtError severity) aborts NewServer entirely. The base cause is almost always [627]/[626] (unsupported cipher) or a malformed account field, so one bad user prevents the whole Shadowsocks inbound from starting.","triggerScenarios":"Building a Shadowsocks server handler from a ServerConfig where any entry in config.Users fails account materialization (bad cipherType, invalid password for the key derivation, missing proto fields).","commonSituations":"Editing users.json or inbound config by hand; panels injecting a legacy cipher for one user; upgrading Xray after a cipher was removed while old users remain.","solutions":["Find the failing user: run xray run -test or check the log for the base error naming the cipher problem, then fix that user's method/password.","Remove or comment out the offending user to bring the inbound back, then re-add it corrected.","Keep all users on AEAD ciphers on modern Xray."],"exampleFix":"// before: one user breaks the whole inbound\n\"settings\": { \"clients\": [\n  { \"method\": \"aes-256-gcm\", \"password\": \"ok\" },\n  { \"method\": \"aes-256-cfb\", \"password\": \"legacy\" } ] }\n// after\n\"settings\": { \"clients\": [\n  { \"method\": \"aes-256-gcm\", \"password\": \"ok\" },\n  { \"method\": \"aes-256-gcm\", \"password\": \"legacy\" } ] }","handlingStrategy":"validation","validationCode":"for _, u := range config.Users {\n  if !isSupportedSSCipher(u.CipherType.String()) {\n    return fmt.Errorf(\"inbound startup blocked by user %q cipher %q\", u.Email, u.CipherType)\n  }\n}","typeGuard":null,"tryCatchPattern":"s, err := shadowsocks.NewServer(ctx, cfg)\nif err != nil {\n  // fail fast, report the offending user from the base error\n  log.Error(\"ss server init failed: \", err)\n  return err\n}","preventionTips":["Run xray run -test on every config change.","Lint all users' ciphers in CI.","Remove stale legacy users before Xray upgrades."],"tags":["shadowsocks","server","config","startup","users"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}