{"record":{"id":"6ef293876cf519c0","repo":"XTLS/Xray-core","slug":"invalid-proxy-protocol-version-xver-only-accept","errorCode":null,"errorMessage":"invalid PROXY protocol version, \"xver\" only accepts 0, 1, 2","messagePattern":"invalid PROXY protocol version, \"xver\" only accepts 0, 1, 2","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/transport_security.go","lineNumber":92,"sourceCode":"\t\t\t\tif s[0] == '@' && len(s) > 1 && s[1] == '@' && (runtime.GOOS == \"linux\" || runtime.GOOS == \"android\") {\n\t\t\t\t\tfullAddr := make([]byte, len(syscall.RawSockaddrUnix{}.Path)) // may need padding to work with haproxy\n\t\t\t\t\tcopy(fullAddr, s[1:])\n\t\t\t\t\ts = string(fullAddr)\n\t\t\t\t}\n\t\t\tdefault:\n\t\t\t\tif _, err = strconv.Atoi(s); err == nil {\n\t\t\t\t\ts = \"localhost:\" + s\n\t\t\t\t}\n\t\t\t\tif _, _, err = net.SplitHostPort(s); err == nil {\n\t\t\t\t\tc.Type = \"tcp\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif c.Type == \"\" {\n\t\t\treturn nil, errors.New(`please fill in a valid value for \"target\"`)\n\t\t}\n\t\tif c.Xver > 2 {\n\t\t\treturn nil, errors.New(`invalid PROXY protocol version, \"xver\" only accepts 0, 1, 2`)\n\t\t}\n\t\tif len(c.ServerNames) == 0 {\n\t\t\treturn nil, errors.New(`empty \"serverNames\"`)\n\t\t}\n\t\tif c.PrivateKey == \"\" {\n\t\t\treturn nil, errors.New(`empty \"privateKey\"`)\n\t\t}\n\t\tif config.PrivateKey, err = base64.RawURLEncoding.DecodeString(c.PrivateKey); err != nil || len(config.PrivateKey) != 32 {\n\t\t\treturn nil, errors.New(`invalid \"privateKey\": `, c.PrivateKey)\n\t\t}\n\t\tif c.MinClientVer != \"\" {\n\t\t\tconfig.MinClientVer = make([]byte, 3)\n\t\t\tvar u uint64\n\t\t\tfor i, s := range strings.Split(c.MinClientVer, \".\") {\n\t\t\t\tif i == 3 {\n\t\t\t\t\treturn nil, errors.New(`invalid \"minClientVer\": `, c.MinClientVer)\n\t\t\t\t}\n\t\t\t\tif u, err = strconv.ParseUint(s, 10, 8); err != nil {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/transport_security.go#L74-L110","documentation":"Thrown by the REALITY builder when xver (PROXY protocol version for the target connection) exceeds 2. Only 0 (disabled), 1 (PROXY v1 text) and 2 (PROXY v2 binary) exist; the field is an int so negatives/other values signal a config mistake.","triggerScenarios":"Setting realitySettings.xver to 3 or higher.","commonSituations":"Confusing xver with a boolean or a protocol version like TLS 1.3; copy-paste from another server's HAProxy config where version numbers differ.","solutions":["Set xver to 0, 1, or 2 (0 unless the target explicitly expects PROXY protocol).","Confirm the target service actually speaks PROXY protocol before setting 1/2."],"exampleFix":"// before\n\"xver\": 3\n// after\n\"xver\": 0","handlingStrategy":"validation","validationCode":"if reality.Xver > 2 {\n    return fmt.Errorf(\"xver %d invalid: only 0, 1, 2 allowed\", reality.Xver)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Treat xver as an enum {0,1,2}, not a free-form int.","Set 0 unless the target service is PROXY-protocol-aware."],"tags":["config","reality","proxy-protocol","validation","go"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}