The SOCKS4 USERID Wire Field

Explain the SOCKS4 USERID wire field and why its interpretation depends on the server rather than SOCKS5 username/password authentication.

SOCKS4 includes a variable-length USERID string terminated by a zero byte. The server interprets that identifier according to its policy; the protocol does not follow it with SOCKS5 username/password subnegotiation.

A SOCKS4 CONNECT request to the documentation address 203.0.113.8, port 443, with an empty USERID is:

04 01 01 bb cb 00 71 08 00

The ninth byte, 0x00, terminates the empty field. It is not the character 0, whose ASCII value is 0x30. Omitting it leaves USERID unfinished.

What the server expects

An empty identifier can be appropriate when the service requires none. If it requires a particular identifier or another access mechanism, follow its documented policy. A supplied name establishes identity only if the server validates it.

SOCKS4a extends destination hostname handling; it does not add SOCKS5 authentication. A service requiring a SOCKS5 account needs a compatible client and method. Putting a password into SOCKS4 USERID cannot substitute for that exchange and may disclose an unrelated credential.

For a rejection, check the SOCKS version, requested destination, and user policy separately.

Erthyglow kevrennek