Vless/XHTTP + Nginx is not working

[airled]

Hi. I have XRay 26.2.6 both on my client and server machines. What I try to achieve:
I want the client to connect to my Nginx server via 443 (with true domain and true certificates), then nginx proxies it to unix socket to the xray server. What my configs look like:

client.json:

{
  "log": {
    "loglevel": "info"
  },
  "inbounds": [
    {
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "myip",
            "port": 443,
            "users": [
              {
                "id": "myid",
                "encryption": "none",
                "flow": ""
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "tls",
        "tlsSettings": {
          "serverName": "mydomain",
          "alpn": ["h2"],
          "fingerprint": "firefox"
        },
        "xhttpSettings": {
          "path": "/database",
          "mode": "auto"
        }
      }
    }
  ]
}

Nginx config:

server {
    listen 443 ssl http2;
    server_name mydomain;

    ssl_certificate     /etc/letsencrypt/live/mydomain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/mydomain/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    location / {
        return 401;
    }

    location /database {
        client_max_body_size 0;
        grpc_read_timeout 315;
        grpc_send_timeout 5m;
        grpc_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        grpc_pass unix:/dev/shm/xrxh.socket;
    }
}

And server config.json:

{
  "log": {
    "loglevel": "info"
  },
  "inbounds": [
    {
      "listen": "/dev/shm/xrxh.socket,0666",
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "myid",
            "flow": ""
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "none",
        "xhttpSettings": {
          "path": "/database",
          "mode": "auto"
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

Xray server sees every request that I did via client but there is no response on the client side. Also, I see some strange entries in nginx log, like these:

2026/03/18 05:14:46 [error] 154170#154170: *71 upstream prematurely closed connection while reading upstream, client: 212.164.25.10, server: mydomain, request: "GET /database/b1b453b8-00c9-405b-95f2-befb98ed2820 HTTP/2.0", upstream: "grpc://unix:/dev/shm/xrxh.socket:", host: "mydomain", referrer: "https://mydomain/database/?x_padding=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
2026/03/18 05:14:46 [error] 154170#154170: *82 upstream prematurely closed connection while reading upstream, client: 212.164.25.10, server: mydomain, request: "GET /database/849dddfa-2b95-41e3-a241-37c0fc552108 HTTP/2.0", upstream: "grpc://unix:/dev/shm/xrxh.socket:", host: "mydomain", referrer: "https://mydomain/database/?x_padding=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
2026/03/18 05:14:46 [error] 154170#154170: *45 upstream prematurely closed connection while reading upstream, client: 212.164.25.10, server: mydomain, request: "GET /database/22c6ce66-1770-4377-8da1-23b1be65af35 HTTP/2.0", upstream: "grpc://unix:/dev/shm/xrxh.socket:", host: "mydomain", referrer: "https://mydomain/database/?x_padding=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"

Any ideas what I can try to make it work?

[airled]

Also. I tried to use reality instead of nginx.
Client:

{
  "log": {
    "loglevel": "info"
  },
  "inbounds": [
    {
      "port": 1080,
      "protocol": "socks",
      "settings": {
        "udp": true
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "vless",
      "settings": {
        "vnext": [
          {
            "address": "myip",
            "port": 8443,
            "users": [
              {
                "id": "myid",
                "encryption": "none",
                "flow": ""
              }
            ]
          }
        ]
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "reality",
        "realitySettings": {
          "fingerprint": "firefox",
          "serverName": "mydomain",
          "publicKey": "mypubkey",
          "shortId": "abcdef",
          "spiderX": "/"
        },
        "xhttpSettings": {
          "path": "/storage",
          "mode": "auto"
        }
      }
    }
  ]
}

Server:

{
  "log": {
    "loglevel": "info"
  },
  "inbounds": [
    {
      "port": 8443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "myid"
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "reality",
        "realitySettings": {
          "show": false,
          "target": "127.0.0.1:16000",
          "xver": 0,
          "serverNames": ["mydomain"],
          "privateKey": "myprivkey",
          "shortIds": ["abcdef"]
        },
        "xhttpSettings": {
          "path": "/storage",
          "mode": "auto"
        },
        "sniffing": {
          "enabled": true
        }
      }
    }
  ],
  "outbounds": [
    {
      "protocol": "freedom"
    }
  ]
}

The behavior is the same. The server catches all the requests but the client does not receive any responses. If I change serverNames and target to google, then everything starts working. Don't understand why

[Studentsov]

I encountered the exact same problem. xray responds with a Content-Length: 0 header, and then transmits the data. nginx terminates the connection because of this.

[hamsteruser]

cat /etc/nginx/sites-available/my.conf
# HTTPS
server {
    listen 443 ssl;
    http2 on;

    server_name domain.com;

    ssl_certificate     /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    server_tokens off;

    # ACME (certbot)
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        root /var/www/html;
        index index.html;
    }

    # 🚀 Xray backend
    location /your/own/path/ {
        proxy_pass http://127.0.0.1:10000/;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_buffering off;
        proxy_request_buffering off;
        proxy_read_timeout 3600;
    }
}

# HTTP → HTTPS
server {
    listen 80;
    server_name domain.com;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

  "inbounds": [
    {
      "listen": "127.0.0.1",
      "port": 10000,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id":
          },
          { 
            "id":
          },
          { 
            "id":
          },
          { 
            "id": 
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "xhttp",
        "security": "none"
      }
    }
  ]

vless://[UUID]@domain.com:443?encryption=none&security=tls&sni=domain.com&alpn=h2&insecure=0&allowInsecure=0&type=xhttp&path=you_hidden_path&mode=stream-up#vless-tcp-nginx

curl -i https://domain.com/your/own/path/ must return code 400! Not 404 and not 502.

And don't set path in inbound settings.

[airled]

Shouldn't it be grpc_pass instead of proxy_pass?
I see example here https://github.com/XTLS/Xray-examples/blob/main/VLESS-XHTTP3-Nginx/nginx.conf
It uses grpc_pass here

[hamsteruser]

Remove these settings:

        "xhttpSettings": {
          "path": "/database",
          "mode": "auto"
        }

curl -i https://domain.com/database/ must return code 400!