{"record":{"id":"65dc2efd0ad269b9","repo":"fatedier/frp","slug":"create-encryption-stream-error-w","errorCode":null,"errorMessage":"create encryption stream error: %w","messagePattern":"create encryption stream error: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/proxy/proxy.go","lineNumber":146,"sourceCode":"\n// wrapWorkConn applies rate limiting, encryption, and compression\n// to a work connection based on the proxy's transport configuration.\n// The returned recycle function should be called when the stream is no longer in use\n// to return compression resources to the pool. It is safe to not call recycle,\n// in which case resources will be garbage collected normally.\nfunc (pxy *BaseProxy) wrapWorkConn(conn net.Conn, encKey []byte) (io.ReadWriteCloser, func(), error) {\n\tvar rwc io.ReadWriteCloser = conn\n\tif pxy.limiter != nil {\n\t\trwc = libio.WrapReadWriteCloser(limit.NewReader(conn, pxy.limiter), limit.NewWriter(conn, pxy.limiter), func() error {\n\t\t\treturn conn.Close()\n\t\t})\n\t}\n\tif pxy.baseCfg.Transport.UseEncryption {\n\t\tvar err error\n\t\trwc, err = libio.WithEncryption(rwc, encKey)\n\t\tif err != nil {\n\t\t\tconn.Close()\n\t\t\treturn nil, nil, fmt.Errorf(\"create encryption stream error: %w\", err)\n\t\t}\n\t}\n\tvar recycleFn func()\n\tif pxy.baseCfg.Transport.UseCompression {\n\t\trwc, recycleFn = libio.WithCompressionFromPool(rwc)\n\t}\n\treturn rwc, recycleFn, nil\n}\n\nfunc (pxy *BaseProxy) SetInWorkConnCallback(cb func(*v1.ProxyBaseConfig, net.Conn, *msg.StartWorkConn) bool) {\n\tpxy.inWorkConnCallback = cb\n}\n\nfunc (pxy *BaseProxy) InWorkConn(conn net.Conn, m *msg.StartWorkConn) {\n\tif pxy.inWorkConnCallback != nil {\n\t\tif !pxy.inWorkConnCallback(pxy.baseCfg, conn, m) {\n\t\t\treturn\n\t\t}","sourceCodeStart":128,"sourceCodeEnd":164,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/client/proxy/proxy.go#L128-L164","documentation":"Thrown when BaseProxy.wrapWorkConn fails to build the encrypted stream (libio.WithEncryption) over a work connection after frps assigns a user connection. WithEncryption initializes an AES-CFB writer/reader from the shared key derived during login; failure almost always means the key material is invalid (empty or malformed), not a network problem. The underlying error is wrapped with %w.","triggerScenarios":"A proxy with transport.useEncryption = true where the client's encKey (derived from the auth token/secret between frpc and frps) is empty or invalid when the work conn is wrapped — typically a key-derivation/mismatch problem rather than transient I/O.","commonSituations":"auth.token mismatch or empty token combined with custom auth hooks producing empty keys; version skew between frpc and frps changing key derivation; only encryption enabled without a usable shared secret.","solutions":["Ensure frpc and frps share the same auth configuration (same auth.token, same auth.method) so both sides derive the same key.","Upgrade frpc and frps to matching versions.","As a diagnostic, temporarily disable transport.useEncryption to confirm the rest of the path works, then re-enable once auth is aligned.","Inspect the wrapped error (%w) — an AEAD/key-size error points at bad key derivation, a network error at the conn itself."],"exampleFix":"# before (frpc.toml)\nauth.token = \"\"\n[proxies.transport]\nuseEncryption = true\n\n# after\nauth.token = \"shared-secret\"\n[proxies.transport]\nuseEncryption = true","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// In custom proxies reusing wrapWorkConn: on encryption-stream error, close conn and surface wrapped cause\nrwc, recycle, err := pxy.wrapWorkConn(conn, encKey)\nif err != nil {\n    var encErr error\n    if errors.As(fmt.Unwrap(err), &encErr) || strings.Contains(err.Error(), \"encryption stream\") {\n        log.Errorf(\"encryption setup failed (auth/token mismatch?): %v\", err)\n    }\n    return err\n}","preventionTips":["Keep auth.token and auth.method identical on frpc and frps when useEncryption is on.","Run same major/minor versions of frpc and frps.","Test with encryption disabled first to isolate key-derivation issues."],"tags":["encryption","auth","transport","frpc"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}