{"record":{"id":"84991b344932334e","repo":"XTLS/Xray-core","slug":"failed-to-add-user-84991b","errorCode":null,"errorMessage":"failed to add user","messagePattern":"failed to add user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/shadowsocks/server.go","lineNumber":41,"sourceCode":"\ntype Server struct {\n\tconfig        *ServerConfig\n\tvalidator     *Validator\n\tpolicyManager policy.Manager\n\tcone          bool\n}\n\n// NewServer create a new Shadowsocks server.\nfunc NewServer(ctx context.Context, config *ServerConfig) (*Server, error) {\n\tvalidator := new(Validator)\n\tfor _, user := range config.Users {\n\t\tu, err := user.ToMemoryUser()\n\t\tif err != nil {\n\t\t\treturn nil, errors.New(\"failed to get shadowsocks user\").Base(err).AtError()\n\t\t}\n\n\t\tif err := validator.Add(u); err != nil {\n\t\t\treturn nil, errors.New(\"failed to add user\").Base(err).AtError()\n\t\t}\n\t}\n\n\tv := core.MustFromContext(ctx)\n\ts := &Server{\n\t\tconfig:        config,\n\t\tvalidator:     validator,\n\t\tpolicyManager: v.GetFeature(policy.ManagerType()).(policy.Manager),\n\t\tcone:          ctx.Value(\"cone\").(bool),\n\t}\n\n\treturn s, nil\n}\n\n// AddUser implements proxy.UserManager.AddUser().\nfunc (s *Server) AddUser(ctx context.Context, u *protocol.MemoryUser) error {\n\treturn s.validator.Add(u)\n}","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/shadowsocks/server.go#L23-L59","documentation":"Server-startup error returned when validator.Add(u) rejects a user during NewServer. In practice the cause is [630]: mixing a non-AEAD cipher with an existing user in a single-port multi-user setup is disallowed because legacy ciphers cannot be distinguished per user on one port. It aborts the whole inbound at startup (AtError).","triggerScenarios":"config.Users contains at least one AEAD user followed by (or preceding) a non-AEAD (legacy stream) user; validator.Add enforces the all-AEAD rule for single-port multi-user and returns an error, which NewServer wraps here.","commonSituations":"Gradually migrating a shared port from legacy to AEAD ciphers user by user; panels appending an old-cipher user to an existing multi-user inbound.","solutions":["Make every user on the single port use an AEAD cipher (aes-*-gcm, *chacha20-poly1305), or give the legacy user its own inbound/port.","Prefer migrating everyone to shadowsocks-2022, which is designed for multi-user single port.","Re-run xray run -test to confirm the inbound builds."],"exampleFix":"// before: mixed ciphers on one port\n\"clients\": [\n  { \"method\": \"chacha20-poly1305\", \"password\": \"a\" },\n  { \"method\": \"aes-256-cfb\", \"password\": \"b\" } ]\n// after\n\"clients\": [\n  { \"method\": \"chacha20-poly1305\", \"password\": \"a\" },\n  { \"method\": \"aes-256-gcm\", \"password\": \"b\" } ]","handlingStrategy":"validation","validationCode":"// enforce all-AEAD before adding any user to a shared port\nfor _, u := range config.Users {\n  if !isAEAD(u.CipherType) {\n    return fmt.Errorf(\"user %q uses non-AEAD cipher; not allowed on multi-user single port\", u.Email)\n  }\n}","typeGuard":"func isAEAD(t CipherType) bool {\n  switch t {\n  case CipherType_AES_128_GCM, CipherType_AES_256_GCM,\n    CipherType_CHACHA20_POLY1305, CipherType_XCHACHA20_POLY1305:\n    return true\n  }\n  return false\n}","tryCatchPattern":"if err := validator.Add(u); err != nil {\n  return fmt.Errorf(\"cannot add user %q to shared port: %w\", u.Email, err)\n}","preventionTips":["Standardize on AEAD (or migrate to shadowsocks-2022) for multi-user ports.","Test the full user list, not just the newest user, when adding to a shared inbound."],"tags":["shadowsocks","server","multi-user","cipher","startup"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}