{"record":{"id":"88b61a7e07b5851c","repo":"XTLS/Xray-core","slug":"vless-users-encryption-should-not-be-in-inbound","errorCode":null,"errorMessage":"VLESS users: \"encryption\" should not be in inbound settings","messagePattern":"VLESS users: \"encryption\" should not be in inbound settings","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/vless.go","lineNumber":85,"sourceCode":"\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\taccount.Id = u.String()\n\n\t\tswitch account.Flow {\n\t\tcase \"\":\n\t\t\taccount.Flow = c.Flow\n\t\tcase vless.XRV:\n\t\tdefault:\n\t\t\treturn errors.New(`VLESS users: \"flow\" doesn't support \"` + account.Flow + `\" in this version`)\n\t\t}\n\n\t\tif len(account.Testseed) < 4 {\n\t\t\taccount.Testseed = c.Testseed\n\t\t}\n\n\t\tif account.Encryption != \"\" {\n\t\t\treturn errors.New(`VLESS users: \"encryption\" should not be in inbound settings`)\n\t\t}\n\n\t\tif account.Reverse != nil {\n\t\t\tif account.Reverse.Tag == \"\" {\n\t\t\t\treturn errors.New(`VLESS users: \"tag\" can't be empty for \"reverse\"`)\n\t\t\t}\n\t\t\tif account.Reverse.Sniffing != nil { // may not be reached: error json unmarshal\n\t\t\t\treturn errors.New(`VLESS users: inbound's \"reverse\" can't have \"sniffing\"`)\n\t\t\t}\n\t\t}\n\n\t\tuser.Account = serial.ToTypedMessage(account)\n\t\tconfig.Users[idx] = user\n\t\treturn nil\n\t}\n\n\tif err := task.ParallelForN(len(c.Users), processClient); err != nil {\n\t\treturn nil, err","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/vless.go#L67-L103","documentation":"VLESS inbound users must not carry an 'encryption' field. Encryption is an outbound/client-side concept; in inbound settings its presence is rejected so the account cannot sneak an encryption mode into the server config.","triggerScenarios":"A clients entry containing \"encryption\": \"none\" (or any value) inside the inbound's settings.clients array.","commonSituations":"Copying a full client JSON (including outbound-style fields) into the server's clients list — the outbound snippet's \"encryption\": \"none\" triggers it.","solutions":["Delete the \"encryption\" key from every client object in inbound settings","Keep \"encryption\": \"none\" only in the VLESS outbound settings on the client side"],"exampleFix":"// before\n{ \"id\": \"8c1f...\", \"encryption\": \"none\" }\n// after\n{ \"id\": \"8c1f...\" }","handlingStrategy":"validation","validationCode":"if gjson.Get(clientRaw, \"encryption\").Exists() {\n    return errors.New(\"client objects in inbound settings must not contain \\\"encryption\\\"\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep server-side client objects minimal: id, email, level, flow","\"encryption\" belongs only in the outbound user object on the client machine"],"tags":["config","vless","inbound","validation"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}