{"record":{"id":"d46e9bb404dc5c6f","repo":"XTLS/Xray-core","slug":"vless-users-please-add-set-encryption-none-fo","errorCode":null,"errorMessage":"VLESS users: please add/set \"encryption\":\"none\" for every user","messagePattern":"VLESS users: please add/set \"encryption\":\"none\" for every user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/vless.go","lineNumber":372,"sourceCode":"\t\t\t\tpadding := 0\n\t\t\t\tfor _, r := range s[3:] {\n\t\t\t\t\tif len(r) < 20 {\n\t\t\t\t\t\tpadding += len(r) + 1\n\t\t\t\t\t\tcontinue\n\t\t\t\t\t}\n\t\t\t\t\tif b, _ := base64.RawURLEncoding.DecodeString(r); len(b) != 32 && len(b) != 1184 {\n\t\t\t\t\t\treturn false\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\taccount.Encryption = account.Encryption[27+len(s[2]):]\n\t\t\t\tif padding > 0 {\n\t\t\t\t\taccount.Padding = account.Encryption[:padding-1]\n\t\t\t\t\taccount.Encryption = account.Encryption[padding:]\n\t\t\t\t}\n\t\t\t\treturn true\n\t\t\t}() && account.Encryption != \"none\" {\n\t\t\t\tif account.Encryption == \"\" {\n\t\t\t\t\treturn nil, errors.New(`VLESS users: please add/set \"encryption\":\"none\" for every user`)\n\t\t\t\t}\n\t\t\t\treturn nil, errors.New(`VLESS users: unsupported \"encryption\": ` + account.Encryption)\n\t\t\t}\n\n\t\t\tuser.Account = serial.ToTypedMessage(account)\n\t\t\tspec.User = user\n\t\t\tbreak\n\t\t}\n\t\tconfig.Vnext = spec\n\t\tbreak\n\t}\n\n\treturn config, nil\n}\n","sourceCodeStart":354,"sourceCodeEnd":387,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/vless.go#L354-L387","documentation":"Thrown by VLessOutboundConfig.Build() when a user's \"encryption\" field is empty (and not a valid mlkem768x25519plus post-quantum spec). Unlike VMess, VLESS has no implicit default encryption: the protocol requires the exact string \"none\" so that the intent is explicit. Omitting the field — very common when copying VMess-style configs — produces this error.","triggerScenarios":"\"users\":[{\"id\":\"uuid\"}] with no \"encryption\" key; \"encryption\":\"\" (empty string). Both full style and share links converted without the encryption field.","commonSituations":"Converting a VMess outbound to VLESS by changing only protocol and id; configs from tutorials that predate the mandatory-encryption rule; older Xray versions that tolerated a missing field, breaking after upgrade.","solutions":["Add \"encryption\":\"none\" to every user object","Or set \"encryption\":\"none\" at the outbound top level in the simplified style","Regenerate the config/link with an up-to-date generator that always emits the field"],"exampleFix":"// before\n\"users\": [ { \"id\": \"b831381d-6324-4d53-ad4f-8cda48b30811\" } ]\n// after\n\"users\": [ { \"id\": \"b831381d-6324-4d53-ad4f-8cda48b30811\", \"encryption\": \"none\" } ]","handlingStrategy":"validation","validationCode":"func validateVlessEncryption(cfg map[string]any) error {\n\toutbounds, _ := cfg[\"outbounds\"].([]any)\n\tfor _, ob := range outbounds {\n\t\tm, _ := ob.(map[string]any)\n\t\tif p, _ := m[\"protocol\"].(string); p != \"vless\" { continue }\n\t\tsettings, _ := m[\"settings\"].(map[string]any)\n\t\tif e, ok := settings[\"encryption\"].(string); ok && e != \"\" { continue }\n\t\tvnext, _ := settings[\"vnext\"].([]any)\n\t\tfor _, v := range vnext {\n\t\t\tep, _ := v.(map[string]any)\n\t\t\tusers, _ := ep[\"users\"].([]any)\n\t\t\tfor i, u := range users {\n\t\t\t\tum, _ := u.(map[string]any)\n\t\t\t\tif e, _ := um[\"encryption\"].(string); e == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"outbound %v: vnext.users[%d] missing encryption\", m[\"tag\"], i)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}","typeGuard":"func vlessEncryptionSet(u map[string]any) bool {\n\te, ok := u[\"encryption\"].(string)\n\treturn ok && e != \"\"\n}","tryCatchPattern":null,"preventionTips":["Emit \"encryption\":\"none\" in every generated VLESS user object","When converting VMess configs to VLESS, add the encryption field explicitly","Lint for missing encryption before deploy — the error message itself says 'add/set for every user'"],"tags":["vless","encryption","outbound","config","validation","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}