{"record":{"id":"601792e2860b1c37","repo":"XTLS/Xray-core","slug":"invalid-token-token","errorCode":null,"errorMessage":"invalid token + token","messagePattern":"invalid token \\+ token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_finalmask.go","lineNumber":861,"sourceCode":"\thost = u.Hostname()\n\tif host == \"\" {\n\t\treturn nil, errors.New(\"invalid host\", host)\n\t}\n\n\tport = u.Port()\n\tif port == \"\" {\n\t\tport = \"443\"\n\t\tif scheme == \"http\" {\n\t\t\tport = \"80\"\n\t\t}\n\t}\n\n\ttoken, err = url.PathUnescape(u.User.String())\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif token == \"\" {\n\t\treturn nil, errors.New(\"invalid token\", token)\n\t}\n\n\tid, err = url.PathUnescape(strings.TrimPrefix(u.EscapedPath(), \"/\"))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif id == \"\" {\n\t\treturn nil, errors.New(\"invalid id\", id)\n\t}\n\n\tif len(c.StunServers) == 0 {\n\t\treturn nil, errors.New(\"empty stunServers\")\n\t}\n\n\tfor _, s := range c.StunServers {\n\t\t_, _, err = net.SplitHostPort(s)\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":843,"sourceCodeEnd":879,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_finalmask.go#L843-L879","documentation":"Thrown by Realm.Build() when the userinfo component of the Realm URL is missing or unescapes to an empty token. The token is taken from u.User (the part before '@'), percent-decoded with url.PathUnescape, and must be non-empty — it authenticates the Realm session.","triggerScenarios":"A URL like 'realm://host:port/id' with no '<token>@' part triggers this. Also triggered when the token consists only of an escaped sequence that decodes to empty, or when '@' is URL-encoded as %40 so the parser sees no userinfo.","commonSituations":"Forgetting the credential portion when hand-assembling the URL; secrets managers returning an empty token; copy-paste from a share link that strips userinfo.","solutions":["Add the token as userinfo: 'realm://<token>@host:port/id'.","Percent-encode special characters in the token rather than omitting it.","Check the injected secret is non-empty before building the config."],"exampleFix":"// before\n\"url\": \"realm://signal.example.com:8443/v1\"\n// after\n\"url\": \"realm://mysecrettoken@signal.example.com:8443/v1\"","handlingStrategy":"validation","validationCode":"u, _ := url.Parse(raw)\nif u.User == nil || u.User.String() == \"\" {\n    return fmt.Errorf(\"realm url is missing the token in userinfo\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check secret-manager outputs are non-empty before injecting them as the token.","Keep the '<token>@' segment in every Realm URL template.","Percent-encode tokens containing '@', ':' or '/'."],"tags":["go","xray","config","validation","url-parsing","authentication"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}