Dynamic / Randomized spiderX Generation for REALITY Subscriptions

Предложения
1

Currently, when configuring VLESS-REALITY in Remnawave, the spiderX path is either static across all generated client configurations or left blank.

I propose adding an option in the subscription generator to dynamically generate unique/randomized spiderX paths for each user’s subscription link (e.g., &spx=/randomString or realistic randomized paths).

The Problem & DPI Risks

  1. Traffic Correlation Across Users (DPI Fingerprinting): When an administrator sets a custom spiderX path (e.g., /X9k4pQ2zW6sF1vMb), that exact same arbitrary string is embedded in the configuration of every single client on that inbound. When dozens or hundreds of distinct user IPs connect to the same SNI using the exact same obscure subpath, it creates a blatant statistical anomaly for Deep Packet Inspection (DPI) systems, making the entire server trivially easy to flag and block.

  2. Client-Side Editing is Impractical:

    • Subscription Overrides: Any manual edits made by an end-user to the spx parameter in their client app (v2rayNG, v2rayN, Sing-box, etc.) get wiped out as soon as the subscription automatically updates.

    • UX Friction: Non-technical users cannot be expected to edit raw URI parameters or JSON profiles.

    • Scale: For administrators managing dozens or hundreds of users, manually generating and distributing unique configs defeats the purpose of an automated panel like Remnawave.

Why This is Technically Straightforward with Xray-core

In Xray-core REALITY:

  • The server-side realitySettings.spiderX operates as a prefix validator.

  • If the server inbound is configured with "spiderX": "/", Xray-core will accept any client path that begins with /.

  • This means no complex core changes or multi-path backend architectures are required. The server can simply have spiderX: "/", while Remnawave handles randomizing the client-side parameter during subscription export.

Proposed Implementation

In Inbound Settings / Subscription Settings, add a toggle:

  • [ ] Randomize Client spiderX in Subscriptions

    • Option A (Random Alphanumeric): Appends a random 8–16 character string (e.g., /k8P2mQ9z).

    • Option B (Path Templates / Custom List): Allows the admin to supply a template or wordlist to mimic realistic paths (e.g., /search?q={random}, /assets/{random}.js, /api/v1/{random}).

Benefits

  • Eliminates uniform traffic signatures across users on the same inbound.

  • Significantly improves survivability against DPI heuristic clustering without requiring manual client configuration.

  • Fully automated and seamless for end users via subscription links.

1 Like