{"record":{"id":"dcc62a0e3094968b","repo":"XTLS/Xray-core","slug":"invalid-username-or-password","errorCode":null,"errorMessage":"invalid username or password","messagePattern":"invalid username or password","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/socks/protocol.go","lineNumber":131,"sourceCode":"\n\tif !hasAuthMethod(expectedAuth, buffer.BytesRange(0, int32(nMethod))) {\n\t\twriteSocks5AuthenticationResponse(writer, socks5Version, authNoMatchingMethod)\n\t\treturn \"\", errors.New(\"no matching auth method\")\n\t}\n\n\tif err := writeSocks5AuthenticationResponse(writer, socks5Version, expectedAuth); err != nil {\n\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t}\n\n\tif expectedAuth == authPassword {\n\t\tusername, password, err := ReadUsernamePassword(reader)\n\t\tif err != nil {\n\t\t\treturn \"\", errors.New(\"failed to read username and password for authentication\").Base(err)\n\t\t}\n\n\t\tif !s.config.HasAccount(username, password) {\n\t\t\twriteSocks5AuthenticationResponse(writer, 0x01, 0xFF)\n\t\t\treturn \"\", errors.New(\"invalid username or password\")\n\t\t}\n\n\t\tif err := writeSocks5AuthenticationResponse(writer, 0x01, 0x00); err != nil {\n\t\t\treturn \"\", errors.New(\"failed to write auth response\").Base(err)\n\t\t}\n\t\treturn username, nil\n\t}\n\n\treturn \"\", nil\n}\n\nfunc (s *ServerSession) handshake5(nMethod byte, reader io.Reader, writer net.Conn) (*protocol.RequestHeader, *TempUDPConn, error) {\n\tvar (\n\t\tusername string\n\t\terr      error\n\t)\n\tif username, err = s.auth5(nMethod, reader, writer); err != nil {\n\t\treturn nil, nil, err","sourceCodeStart":113,"sourceCodeEnd":149,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/proxy/socks/protocol.go#L113-L149","documentation":"Thrown in auth5 (proxy/socks/protocol.go:131) when the RFC 1929 message parsed correctly but config.HasAccount(username, password) returned false. The server responds 0x01 0xFF (auth failure) and closes; the credentials simply do not match any account on the inbound.","triggerScenarios":"Client authenticates with a username/password pair that is not in the inbound's accounts list, or the account was removed/reloaded with different credentials; also possible hash/copy mistakes when pasting secrets.","commonSituations":"Typo'd password in client config; rotated credentials updated on one side only; environments where the inbound config was regenerated; trailing whitespace/newlines from copy-paste in JSON.","solutions":["Compare the exact username/password the client sends against the inbound's accounts entry in the Xray config JSON.","Watch for invisible characters: trailing spaces, CR/LF, or JSON escaping issues in the credentials.","If credentials were rotated, update both the server accounts list and every client, then restart/reload.","Enable access logging on the inbound to confirm which username is actually arriving."],"exampleFix":"// before: mismatch between client and server credentials\n// client: user=alice pw=secret1\n{ \"accounts\": [{ \"user\": \"alice\", \"pass\": \"secret2\" }] }\n\n// after: aligned\n{ \"accounts\": [{ \"user\": \"alice\", \"pass\": \"secret1\" }] }","handlingStrategy":"validation","validationCode":"// Server-side: verify an account exists before enabling password auth\nif len(inbound.Settings.Accounts) == 0 && inbound.Settings.Auth == \"password\" {\n    return fmt.Errorf(\"password auth enabled but no accounts configured\")\n}\n// Client-side: assert credentials are set before dialing\nif serverAuthRequired && (user == \"\" || pass == \"\") {\n    return fmt.Errorf(\"credentials missing for authenticated SOCKS5 server\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"invalid username or password\") {\n    // surface a clear message; do not retry blindly with the same credentials\n    return errors.New(\"SOCKS5 credentials rejected: check inbound accounts list\")\n}","preventionTips":["Manage credentials in a single source of truth shared by server and client configs.","Trim whitespace when pasting secrets into JSON configs.","Log the arriving username (never the password) to debug mismatches."],"tags":["socks","socks5","authentication","credentials","config","xray"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}