{"record":{"id":"4c26f35bec06c679","repo":"shadowsocks/shadowsocks-rust","slug":"server-method-doesn-t-support-extended-identity-he","errorCode":null,"errorMessage":"server method doesn't support Extended Identity Header (EIH), remove `users`","messagePattern":"server method doesn't support Extended Identity Header \\(EIH\\), remove `users`","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/shadowsocks-service/src/config.rs","lineNumber":2973,"sourceCode":"                ServerAddr::DomainName(dn, port) => {\n                    if dn.is_empty() || *port == 0 {\n                        let err = Error::new(\n                            ErrorKind::Malformed,\n                            \"`server` shouldn't be an empty string, `server_port` shouldn't be 0\",\n                            None,\n                        );\n                        return Err(err);\n                    }\n                }\n            }\n\n            // Users' key must match key length\n            if let Some(user_manager) = server.user_manager() {\n                #[cfg(feature = \"aead-cipher-2022\")]\n                if server.method().is_aead_2022() {\n                    use shadowsocks::config::method_support_eih;\n                    if user_manager.user_count() > 0 && !method_support_eih(server.method()) {\n                        let err = Error::new(\n                            ErrorKind::Invalid,\n                            \"server method doesn't support Extended Identity Header (EIH), remove `users`\",\n                            Some(format!(\"method {}\", server.method())),\n                        );\n                        return Err(err);\n                    }\n                }\n\n                let key_len = server.method().key_len();\n                for user in user_manager.users_iter() {\n                    if user.key().len() != key_len {\n                        let err = Error::new(\n                            ErrorKind::Malformed,\n                            \"`users[].password` length must be exactly the same as method's key length\",\n                            None,\n                        );\n                        return Err(err);\n                    }","sourceCodeStart":2955,"sourceCodeEnd":2991,"githubUrl":"https://github.com/shadowsocks/shadowsocks-rust/blob/8eb0f0a65b1d976ab6bed5787327ef86529b0435/crates/shadowsocks-service/src/config.rs#L2955-L2991","documentation":"This error is raised during server config validation in crates/shadowsocks-service/src/config.rs when a server is configured with a `users` list (EUI/EIH users) but the chosen cipher method does not support Extended Identity Header (EIH). EIH is only supported by AEAD-2022 ciphers; pairing users with e.g. aes-256-gcm makes the multi-user identity mechanism impossible, so validation fails fast at config load.","triggerScenarios":"Building a ServerConfig via Config::from_str/from_url (or loading a JSON config) where `servers[].users` is non-empty and the `method` is not an AEAD-2022 cipher (method_support_eih() returns false).","commonSituations":"Copy-pasting a multi-user config from an AEAD-2022 example but leaving the method as aes-256-gcm or chacha20-ietf-poly1305; enabling EUI users after switching methods down; tooling that appends users without checking the cipher.","solutions":["Change the server method to an AEAD-2022 cipher that supports EIH, e.g. 2022-blake3-aes-128-gcm, 2022-blake3-aes-256-gcm, or 2022-blake3-chacha20-poly1305","Remove the `users` array from the server config if multi-user EUI support is not needed","Ensure every user password/base64 key length matches the method's key length (also required for AEAD-2022)"],"exampleFix":"// before\n{\"method\":\"aes-256-gcm\",\"users\":[{\"password\":\"<key>\"}]}\n// after\n{\"method\":\"2022-blake3-aes-256-gcm\",\"users\":[{\"password\":\"<base64-key-same-length>\"}]}","handlingStrategy":"validation","validationCode":"fn supports_eih(method: &str) -> bool {\n    matches!(method, \"2022-blake3-aes-128-gcm\" | \"2022-blake3-aes-256-gcm\" | \"2022-blake3-chacha20-poly1305\")\n}\n// before load: assert!(users.is_empty() || supports_eih(&server.method));","typeGuard":"fn is_eih_capable(method: &ServerConfigMethod) -> bool {\n    shadowsocks::config::method_support_eih(method)\n}","tryCatchPattern":"match config.validate() {\n    Err(e) if e.to_string().contains(\"Extended Identity Header\") => eprintln!(\"remove `users` or switch to an AEAD-2022 method: {e}\"),\n    Err(e) => return Err(e),\n    Ok(v) => v,\n}","preventionTips":["Only combine `users` with AEAD-2022 (2022-blake3-*) methods","Centralize method/user validation in one config-check function","Pin method and users in the same config template so they can't drift"],"tags":["config","shadowsocks","validation","aead-2022"],"backgroundTag":"invalid-config-value","analyzedSha":"8eb0f0a65b1d976ab6bed5787327ef86529b0435","analyzedAt":"2026-09-09T12:20:43.168Z","contentChangedAt":"2026-09-09T12:20:43.168Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}