{"record":{"id":"a2599896eb2a2170","repo":"XTLS/Xray-core","slug":"failed-to-write-auth-response","errorCode":null,"errorMessage":"failed to write auth response","messagePattern":"failed to write auth response","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":120,"sourceCode":"\tbuffer := buf.StackNew()\n\tdefer buffer.Release()\n\n\tif _, err = buffer.ReadFullFrom(reader, int32(nMethod)); err != nil {\n\t\treturn \"\", errors.New(\"failed to read auth methods\").Base(err)\n\t}\n\n\tvar expectedAuth byte = authNotRequired\n\tif s.config.AuthType == AuthType_PASSWORD {\n\t\texpectedAuth = authPassword\n\t}\n\n\tif !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {\n\t\twriteSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)\n\t\treturn \"\", errors.New(\"no matching auth method\")\n\t}\n\n\tif err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {\n\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t}\n\n\tif expectedAuth == authPassword {\n\t\tusername, password, err := ReadUsernamePassword(reader)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.New(\"failed to read username and password for authentication\").Base(err)\n\t\t}\n\n\t\tif !s.config.HasAccount(username, password) {\n\t\t\twriteSocks5AuthenticationResponse(writer, 0x01, 0xFF)\n\t\t\treturn \"\", errors.New(\"invalid username or password\")\n\t\t}\n\n\t\tif err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {\n\t\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t\t}\n\t\treturn username, nil\n\t}","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L102-L138","documentation":"Thrown in auth5 (proxy/socks/protocol.go:120) when writing the SOCKS5 method-selection reply (VER 0x05 + selected method) to the client fails. The protocol logic is fine; the underlying net.Conn write returned an error (broken pipe, connection reset, closed socket).","triggerScenarios":"The client disconnects immediately after sending its method list (fire-and-forget probe); the TCP connection is reset by a middlebox or NAT; the writer (net.Conn) was closed concurrently by a timeout handler.","commonSituations":"Scanners that open, write, and close; mobile/flaky networks dropping the session mid-handshake; aggressive handshake timeouts on the server side closing the conn during negotiation.","solutions":["Check the base error: EPIPE/ECONNRESET means the peer went away — usually harmless noise from probes or flaky clients.","If frequent, verify the handshake timeout policy is not too small (policy timeouts 'handshake').","Ensure no firewall/middlebox between client and server injects RSTs on the SOCKS port."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"failed to write auth response\") {\n    // peer disconnected during negotiation; nothing to salvage\n    return nil // or log at debug level and drop the connection\n}","preventionTips":["Clients should keep the connection open until negotiation completes.","Set a sane handshake timeout so dead sessions are reaped promptly."],"tags":["socks","socks5","network","write-failure","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}