{"record":{"id":"6a0a79696adf6e57","repo":"XTLS/Xray-core","slug":"server-rejects-account-code","errorCode":null,"errorMessage":"server rejects account: {code}","messagePattern":"server rejects account: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":484,"sourceCode":"\n\tif authByte == authPassword {\n\t\tb.Clear()\n\t\taccount := request.User.Account.(*Account)\n\t\tcommon.Must(b.WriteByte(0x01))\n\t\tcommon.Must(b.WriteByte(byte(len(account.Username))))\n\t\tcommon.Must2(b.WriteString(account.Username))\n\t\tcommon.Must(b.WriteByte(byte(len(account.Password))))\n\t\tcommon.Must2(b.WriteString(account.Password))\n\t\tif err := buf.WriteAllBytes(writer, b.Bytes(), nil); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\tb.Clear()\n\t\tif _, err := b.ReadFullFrom(reader, 2); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\tif b.Byte(1) != 0x00 {\n\t\t\treturn nil, errors.New(\"server rejects account: \", b.Byte(1))\n\t\t}\n\t}\n\n\tb.Clear()\n\n\tcommand := byte(cmdTCPConnect)\n\tif request.Command == protocol.RequestCommandUDP {\n\t\tcommand = byte(cmdUDPAssociate)\n\t}\n\tcommon.Must2(b.Write([]byte{socks5Version, command, 0x00 /* reserved */}))\n\tif request.Command == protocol.RequestCommandUDP {\n\t\tcommon.Must2(b.Write([]byte{1, 0, 0, 0, 0, 0, 0 /* RFC 1928 */}))\n\t} else {\n\t\tif err := addrParser.WriteAddressPort(b, request.Address, request.Port); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t}\n","sourceCodeStart":466,"sourceCodeEnd":502,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L466-L502","documentation":"Thrown in the SOCKS5 client's username/password sub-negotiation (RFC 1929) when the server's reply status byte is non-zero, i.e. the credentials were rejected. The number in the message is the server's status code (commonly 0x01 = general failure).","triggerScenarios":"Auth method 0x02 negotiated, Xray sent username/password from the outbound account, and the server validated them and replied with status != 0x00. Happens on every connection attempt until credentials are fixed.","commonSituations":"Wrong password or username in the outbound config; password changed server-side but not client-side; trailing whitespace/newline pasted into config credentials; server user database reloaded without the account.","solutions":["Re-enter the exact username/password in the outbound servers.users entry, watching for invisible whitespace.","Verify the account still exists on the SOCKS5 server side (its users list).","Test the same credentials with curl -x socks5://user:pass@host:port to confirm which side is wrong.","If the server is Xray too, check its inbound users and any policy level restrictions."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := client.Process(ctx, link, dialer); err != nil {\n\tif strings.Contains(err.Error(), \"server rejects account\") {\n\t\talertConfigOwner(\"trojan/socks credentials rejected by server\")\n\t}\n\treturn err\n}","preventionTips":["Trim whitespace when pasting credentials into configs.","Automate credential rotation with a shared secret store.","Add an auth canary check (one proxied HEAD request) after deploying credential changes."],"tags":["socks","socks5","authentication","credentials","client"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}