{"record":{"id":"51e851e9d9f623b5","repo":"XTLS/Xray-core","slug":"socks-4-is-not-allowed-when-auth-is-required","errorCode":null,"errorMessage":"socks 4 is not allowed when auth is required.","messagePattern":"socks 4 is not allowed when auth is required\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":55,"sourceCode":")\n\nvar addrParser = protocol.NewAddressParser(\n\tprotocol.AddressFamilyByte(0x01, net.AddressFamilyIPv4),\n\tprotocol.AddressFamilyByte(0x04, net.AddressFamilyIPv6),\n\tprotocol.AddressFamilyByte(0x03, net.AddressFamilyDomain),\n)\n\ntype ServerSession struct {\n\tconfig       *ServerConfig\n\taddress      net.Address\n\tport         net.Port\n\tlocalAddress net.Address\n}\n\nfunc (s *ServerSession) handshake4(cmd byte, reader io.Reader, writer io.Writer) (*protocol.RequestHeader, error) {\n\tif s.config.AuthType == AuthType_PASSWORD {\n\t\twriteSocks4Response(writer, socks4RequestRejected, net.AnyIP, net.Port(0))\n\t\treturn nil, errors.New(\"socks 4 is not allowed when auth is required.\")\n\t}\n\n\tvar port net.Port\n\tvar address net.Address\n\n\t{\n\t\tbuffer := buf.StackNew()\n\t\tif _, err := buffer.ReadFullFrom(reader, 6); err != nil {\n\t\t\tbuffer.Release()\n\t\t\treturn nil, errors.New(\"insufficient header\").Base(err)\n\t\t}\n\t\tport = net.PortFromBytes(buffer.BytesRange(0, 2))\n\t\taddress = net.IPAddress(buffer.BytesRange(2, 6))\n\t\tbuffer.Release()\n\t}\n\n\tif _, err := ReadUntilNull(reader); /* user id */ err != nil {\n\t\treturn nil, err","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L37-L73","documentation":"Thrown by ServerSession.handshake4 (proxy/socks/protocol.go:55) when a client opens a SOCKS4/4a connection while the inbound is configured with AuthType_PASSWORD. SOCKS4 has no username/password sub-negotiation compatible with the server's account requirement, so the server immediately writes a socks4RequestRejected response and refuses the handshake.","triggerScenarios":"Inbound socks server config has auth_type: PASSWORD (or accounts set) and a client connects with protocol version byte 0x04, e.g. curl --socks4, an old app hardcoded to SOCKS4, or a port-scanner probe.","commonSituations":"Mixing legacy SOCKS4 clients with an authenticated Xray inbound; forgetting that enabling accounts implicitly requires SOCKS5 username/password auth; a security scanner testing the exposed port.","solutions":["Switch the client to SOCKS5 (curl --socks5-hostname, proxy settings 'SOCKS v5') and supply the configured username/password.","If SOCKS4 support is genuinely required, remove the accounts / set auth_type to NO_AUTH on that inbound (accepting that anyone can use it).","Expose a separate unauthenticated inbound on a protected interface for the legacy SOCKS4 client."],"exampleFix":"# before: client uses SOCKS4 against an auth-required inbound\ncurl --socks4 127.0.0.1:1080 https://example.com\n\n# after: client uses SOCKS5 with credentials\ncurl --socks5-hostname user:pass@127.0.0.1:1080 https://example.com","handlingStrategy":"validation","validationCode":"// Before connecting, verify compatibility: SOCKS4 requires an unauthenticated inbound\nif clientVersion == 4 && serverConfigAuth == \"password\" {\n    log.Fatal(\"SOCKS4 cannot be used against a password-authenticated inbound; use SOCKS5\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"socks 4 is not allowed when auth is required\") {\n    // fall back to SOCKS5 with credentials\n    return dialSocks5(user, pass)\n}","preventionTips":["Standardize clients on SOCKS5; SOCKS4 is legacy.","Document which inbounds require auth and which credentials they expect.","Never enable SOCKS4-compatible no-auth inbounds on public interfaces."],"tags":["socks","protocol","authentication","config","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}