need VLESS with Flow & Seed

[Deepseaon]

Is your feature request related to a problem?

xray core start said The feature VLESS (with no Flow, etc.) is deprecated, not recommended for using and might be removed. Please migrate to VLESS with Flow & Seed as soon as possible.

Describe the solution you'd like

The current control panel does not allow configuring flow when using xhttp. We hope that flow can be configured in all user settings.

Describe alternatives you've considered

No response

Checklist

• This feature report is written entirely in English.

[badmast]

You must use TCP (RAW)! It's already there.

[Deepseaon]

You must use TCP (RAW)! It's already there.

Thank you for your reply. However, based on information from the Xray repository, it seems that protocols without flow may be completely deprecated in the future. This means that even when using non-TCP protocols, flow should still be configured. Perhaps my understanding of this suggestion is slightly off. However, when testing with a manually configured Xray, it was verified that using protocols like XHTTP with flow configured allowed for normal connections. Therefore, when using the latest Vless ENC quantum-resistant configuration, I found that I couldn't configure flow in the control panel, nor could I configure it manually. So, I hope that at least an option to configure flow can be added for XHTTP. This protocol has been tested and can use flow, and RPRX also recommends using flow.

[badmast]

Here is why TCP (RAW) paired with Flow (xtls-rprx-vision) is the ultimate standard for simulating browser behavior, and why transports like xHTTP are not ideal for this specific goal:

1. The Anatomy of a Normal Browser Connection
   To understand why TCP (RAW) is required, we must look at exactly what a Deep Packet Inspection (DPI) firewall sees when a real user opens Google Chrome and visits a secure website:

Transport Layer: The browser opens a raw TCP connection.

Encryption Layer: The browser immediately sends a TLS Client Hello packet to start the encryption handshake.

Application Layer: Only after the TLS handshake is complete does the browser start sending HTTP/2 or HTTP/3 requests inside the encrypted tunnel.

2. Why TCP (RAW) + Flow (Vision) is the Perfect Mimic
   The goal of the xtls-rprx-vision Flow is to make your VLESS traffic mathematically indistinguishable from the standard Chrome behavior described above. It achieves this through two strict requirements:

Zero Encapsulation: By using TCP (RAW), Xray does not wrap your traffic in any proxy-specific transport layers. The outermost layer is pure TCP, immediately followed by pure TLS. This exactly matches a browser.

Packet Size and Timing (Padding): Advanced firewalls (like the GFW) measure the exact byte size of the first 10-15 packets of a connection. xtls-rprx-vision actively analyzes your outbound traffic and injects dummy data (padding) so that your TLS handshake packets match the exact byte-length of a typical Chrome TLS 1.3 handshake.

3. Why Not xHTTP? (The Problem with Extra Transports)
   xHTTP is a brilliant, modern transport protocol in Xray (designed to replace WebSocket and gRPC). It provides excellent multiplexing and is highly resilient. However, you can only use xHTTP if you are putting your server behind a CDN (like Cloudflare). If you have a direct connection (like your setup with your own domain and IP), using xHTTP defeats the purpose of Vision for the following reasons:

It Breaks the Byte-Counting: Transports like xHTTP, WebSocket, or gRPC add their own specific headers, framing, and chunking to the data stream before it gets encrypted. Because these frames alter the size and sequence of the packets, the xtls-rprx-vision engine can no longer guarantee that the final encrypted packets will match a normal browser's signature.

The "TLS-in-TLS" Problem: When you use xHTTP, your VLESS traffic (which is often already encrypted HTTPS data from your local browser) is wrapped inside xHTTP frames, and then encrypted again by your server's TLS. This double-encryption creates a heavy, unnatural traffic pattern that DPI firewalls can detect using entropy analysis. Vision specifically eliminates this double-encryption, but it needs direct, raw TCP access to do so.

The Verdict
Can you use xHTTP? Yes, but only if you are forced to hide your server behind a CDN where raw TCP is not supported.

If you have a direct IP and a domain, VLESS + TCP (RAW) + TLS + Vision is the absolute apex of anti-censorship technology because it strips away all proxy-like behavior and leaves nothing but a mathematically perfect clone of a normal web browser.

[acidroper]

The Verdict Can you use xHTTP? Yes, but only if you are forced to hide your server behind a CDN where raw TCP is not supported.

If you have a direct IP and a domain, VLESS + TCP (RAW) + TLS + Vision is the absolute apex of anti-censorship technology because it strips away all proxy-like behavior and leaves nothing but a mathematically perfect clone of a normal web browser.

Nice LLM-generated text. However, if one wants to use a proxy behind a CDN, there should be a flow setting for the XHTTP+VLESS Encryption configuration within 3X-UI. See: XTLS/Xray-core#5568 (comment)
P.S. Don't trust LLMs blindly.

[Anderhar]

The "TLS-in-TLS" Problem: When you use xHTTP, your VLESS traffic (which is often already encrypted HTTPS data from your local browser) is wrapped inside xHTTP frames, and then encrypted again by your server's TLS.

Are you aware of any solid evidence that Vision is unable to protect XHTTP from the TLS-in-TLS problem?

However, if one wants to use a proxy behind a CDN, there should be a flow setting for the XHTTP+VLESS Encryption configuration within 3X-UI.

Actually, I still haven’t been able to find any convincing proof that XHTTP-Reality-Vision is in any way inferior to TCP-Reality-Vision, even when used without CDN/Nginx in the stream-one mode.
Initially, XHTTP was indeed incomplete before the introduction of VLESS Encryption and without Vision support, so disabling Flow in 3X-UI was entirely justified. But I’m completely confused to justify it nowadays.