XHTTP: A Next-Gen Protocol for Circumventing Censorship with Enhanced Speed and Flexibility

A new transport protocol called XHTTP has emerged as a potential solution for bypassing internet censorship. XHTTP builds upon previous attempts, like the Meek protocol, to disguise proxy traffic as normal HTTPS traffic, but aims to address Meek’s performance limitations. This article breaks down the core concepts, setup, and advanced configurations of XHTTP for tech-savvy users.

The Evolution from Meek to SplitHttp to XHTTP

In May 2023, the Meek transport protocol was introduced to V2Ray, offering the advantage of encapsulating proxy data within standard HTTPS traffic, effectively mimicking regular website access. This allowed Meek to leverage Content Delivery Networks (CDNs) to circumvent censorship. However, Meek suffered from slow speeds, making it suitable only as a backup option.

Around the same time, the idea of improving Meek’s performance by using “packet-up, stream-down” data transfer was proposed. In June 2024, the SplitHttp protocol was developed based on this concept, significantly enhancing downstream transfer speeds. SplitHttp has since evolved into XHTTP, incorporating features such as stream-up, byte padding, multiplexing, and uplink/downlink separation.

Understanding the Technical Differences: TCP, Meek, and XHTTP

To understand XHTTP’s advantages, let’s compare it to traditional TCP and Meek:

• TCP (Traditional): A standard TCP connection transmits data as a continuous stream of bytes between the client and the server.
• Meek: Meek divides the request into small HTTP packets (packet-up) and sends them to the Meek node. The node reassembles the packets and forwards the request. The response is similarly divided into small HTTP packets (packet-down) and sent back to the client.
• XHTTP (SplitHttp): XHTTP also uses packet-up for the initial request, but the server responds with a stream of data in chunked format (stream-down), improving efficiency.

The key difference lies in the downstream data transfer. Stream-down is inherently more efficient than packet-down, as it eliminates the overhead of constantly requesting individual data packets from the server.

Setting Up XHTTP with Reality: A Step-by-Step Guide

This tutorial outlines setting up XHTTP with Reality for a secure and potentially censorship-resistant proxy. While the original source mentions using 3XUI, a web panel, for ease of setup, users should be aware of the security implications of using web panels, especially those with known vulnerabilities.

1. Install 3XUI: Use the provided one-command installation script. (Note: Exercise caution and understand the risks associated with using web panels.)
2. Access the XUI Backend: Navigate to the provided URL and log in.
3. Add an Inbound: Create a new inbound connection with the following settings:
   • Port: 443 (recommended)
   • Security: Reality
   • Set Key: Configure a unique key.
   • Domain: Use a domain suitable for your VPS.
   • Transport: XHTTP
   • Path: Set a path (e.g., a portion of the user ID).
   • Other Settings: Use default values.
4. Add the Inbound: Save the configurations and create the inbound.

This setup creates a VLESS + XHTTP + Reality node, leveraging XHTTP’s features such as byte padding, multiplexing, and uplink/downlink separation.

Using XHTTP with CDN for Enhanced Circumvention

Like Meek, XHTTP can be used in conjunction with a CDN to further obfuscate proxy traffic. The configuration is similar to setting up WS over CDN:

1. Add an Inbound: Create a new inbound connection with the following settings:
   • Port: 80 (or another available port)
   • Transport: XHTTP
   • Path: Set a path.
2. Configure CDN (e.g., Cloudflare):
   • DNS Record: Create an A record pointing your domain to the VPS IP address, with proxying enabled.
   • TLS Encryption: Set the TLS encryption mode to “Flexible.”
   • GRPC: Enable GRPC for streaming uploads (if supported by your CDN).
   • Origin Rules (Cloudflare Specific): Create a rule to rewrite traffic from port 80 to the port used by your XHTTP inbound (e.g., 6666).

After configuring the CDN, update your proxy client to use the CDN domain and port 443, with TLS enabled. If desired, use IP optimization techniques and set the SNI field to your domain.

Advanced Configuration: Uplink/Downlink Separation

XHTTP supports uplink/downlink separation, which can potentially increase resistance to censorship by splitting the inbound and outbound connections across different domains. This technique is designed to complicate deep packet inspection.

To implement uplink/downlink separation:

1. Configure Two Domains: Point two separate domains (e.g., a.example.com for uplink and b.example.com for downlink) to the same VPS IP address.
2. Configure the Proxy Client: Use the provided downlink configuration code snippet, modifying it with the appropriate IP address (or optimized IP), ports, and paths.
3. Update the Uplink Node: Edit the uplink node configuration and add the downlink configuration as an extra parameter.

This configuration establishes separate connections for uplink and downlink traffic, potentially enhancing censorship resistance.

Uplink CDN, Downlink Reality: A Hybrid Approach

For scenarios where the VPS has a fast direct connection (e.g., GIA) and CDN usage would be wasteful, a hybrid approach can be used: CDN for uplink and Reality for downlink.

1. Configure a Reality Node: Set up a standard VLESS + Vision + Reality node.
2. Configure Fallback: Add a fallback rule to the Reality node, directing traffic to the port used by the bare XHTTP node (e.g., 6666). This requires temporarily disabling Reality security to access the fallback settings in 3XUI.
3. Implement Uplink/Downlink Separation: Apply uplink/downlink seperation to route downlink via reality.

In this configuration, the proxy client connects to the CDN for uplink and establishes a direct Reality connection for downlink, effectively bypassing the CDN for outbound traffic while maintaining a degree of censorship resistance through the CDN’s obfuscation of the uplink connection.

XHTTP represents a significant step forward in censorship circumvention technology, offering improved performance and flexibility compared to previous solutions. By understanding the core concepts and configuration options, users can leverage XHTTP to bypass internet censorship and access information freely.