# How CFnew Parses VLESS Protocol Headers: Complete Technical Guide

> Learn how CFnew parses VLESS protocol headers. This technical guide explains CFnew's approach using native URL APIs to extract header fields for your VLESS connections.

- Repository: [byJoey/cfnew](https://github.com/byJoey/cfnew)
- Tags: deep-dive
- Published: 2026-05-23

---

**CFnew parses VLESS protocol headers by treating share-links as standard URLs and extracting fields using the native `URL` and `URLSearchParams` APIs within the `parseLinkToClashNode` function located in the `明文源吗` source file.**

CFnew, developed by byJoey, is a Cloudflare Worker-based subscription converter that transforms proxy share-links into client-compatible configurations. Understanding how CFnew parses VLESS protocol headers reveals the internal mechanics of modern proxy link parsing and the standardized approach to extracting transport-layer parameters from VLESS URLs according to RFC 3986.

## VLESS Parsing Architecture in CFnew

The parsing logic resides in `明文源吗` (the plain-source worker file), specifically within the `parseLinkToClashNode` function spanning lines 1542–1590. Rather than implementing fragile regex-based extraction, CFnew leverages the JavaScript `URL` constructor and `URLSearchParams` interface to destructure VLESS links into their constituent components.

## Step-by-Step VLESS Parsing Implementation

### URL Object Initialization and Core Field Extraction

When a link begins with `vless://`, the parser immediately instantiates a URL object:

```javascript
const url = new URL(link);

```

This operation provides structured access to all URI components. The function extracts core identity fields directly from URL properties:

- **UUID**: Retrieved from `url.username` (the userinfo portion of the URI)
- **Server**: Extracted via `url.hostname`, supporting IPv4, IPv6, and domain names
- **Port**: Parsed as an integer with fallback logic—`parseInt(url.port) || 443`—defaulting to 443 when unspecified
- **Node Name**: Decoded from the fragment identifier using `decodeURIComponent(url.hash.substring(1))`

### Query Parameter Processing with URLSearchParams

Transport and security parameters reside in the query string, processed via:

```javascript
const params = new URLSearchParams(url.search);

```

Key VLESS parameters extracted include:

- **Security/TLS**: Determined by evaluating `params.get('security') === 'tls' || params.get('tls') === 'true'`
- **Transport Type**: Defaults to WebSocket (`ws`) via `params.get('type') || 'ws'`
- **WebSocket Path**: Defaults to `/?ed=2048` if `params.get('path')` is absent
- **HTTP Host**: Falls back to the server address via `params.get('host') || server`
- **SNI (Server Name Indication)**: Defaults to the host value via `params.get('sni') || host`
- **ALPN**: Split into an array when present using `alpnRaw.split(',').map(a => a.trim()).filter(Boolean)`
- **Client Fingerprint**: Defaults to `"chrome"` when the `fp` or `client-fingerprint` parameter is unavailable

### TLS and Security Parameter Handling

When TLS is enabled, the node object receives additional cryptographic configuration:

```javascript
node.servername = servername;
node.alpn = alpnRaw.split(',').map(a => a.trim()).filter(Boolean);
node['skip-cert-verify'] = false;

```

The `servername` parameter prioritizes explicit SNI values over inferred hostnames, ensuring proper TLS handshake behavior in environments with strict certificate validation.

### WebSocket Transport Configuration

For WebSocket-based transports (`network === 'ws'`), CFnew constructs dedicated options:

```javascript
node['ws-opts'] = {
  path,
  headers: { Host: host },
};

```

This structure maps directly to Clash/Meta configuration specifications, preserving the HTTP Host header integrity required for CDN-backed VLESS endpoints.

### Encrypted Client Hello (ECH) Support

Modern privacy features are supported through the `ech` query parameter. When present, CFnew injects ECH configuration:

```javascript
node['ech-opts'] = {
  enable: true,
  'query-server-name': customECHDomain || 'cloudflare-ech.com',
};

```

This enables Encrypted Client Hello functionality, defaulting to Cloudflare's ECH infrastructure when no custom domain is specified.

## Complete Node Construction Example

The following example demonstrates the complete parsing flow for a standard VLESS link:

```javascript
// Example VLESS share-link
const vlessLink = 'vless://01234567-89ab-cdef-0123-456789abcdef@myserver.example.com:443?security=tls&type=ws&path=%2F?ed%3D2048&host=myserver.example.com&sni=myserver.example.com&alpn=h2,http/1.1&fp=chrome#My-Node';

// CFnew internal parsing
const node = parseLinkToClashNode(vlessLink);

```

The resulting node object conforms to the following structure:

```json
{
  "name": "My-Node",
  "type": "vless",
  "server": "myserver.example.com",
  "port": 443,
  "uuid": "01234567-89ab-cdef-0123-456789abcdef",
  "tls": true,
  "network": "ws",
  "client-fingerprint": "chrome",
  "servername": "myserver.example.com",
  "alpn": ["h2", "http/1.1"],
  "skip-cert-verify": false,
  "ws-opts": {
    "path": "/?ed=2048",
    "headers": { "Host": "myserver.example.com" }
  }
}

```

## Summary

- CFnew implements VLESS parsing in the `parseLinkToClashNode` function within `明文源吗` (lines 1542–1590), utilizing standard web platform APIs rather than regex-based extraction.
- **Core fields** (UUID, server, port, name) are extracted from the `URL` object properties (`username`, `hostname`, `port`, `hash`).
- **Transport parameters** (WebSocket path, host, security type) are parsed via `URLSearchParams` with sensible defaults: network defaults to `ws`, path to `/?ed=2048`, and fingerprint to `chrome`.
- **TLS configuration** includes SNI derivation, ALPN array splitting, and strict certificate verification (`skip-cert-verify: false`).
- **ECH support** is triggered by the `ech` query parameter, enabling modern privacy extensions with Cloudflare-compatible defaults.

## Frequently Asked Questions

### Where is the VLESS parsing logic located in the CFnew repository?

The VLESS parsing implementation resides in the `明文源吗` file within the `parseLinkToClashNode` function, specifically between lines 1542 and 1590 according to the byJoey/cfnew source code. This single function handles the transformation from VLESS share-link to Clash-compatible node object.

### What default values does CFnew use for VLESS parameters?

CFnew applies several defaults when parsing VLESS links: port defaults to **443**, transport type (`network`) defaults to **ws** (WebSocket), WebSocket path defaults to **`/?ed=2048`**, and client fingerprint defaults to **chrome**. The SNI field defaults to the host parameter, which itself defaults to the server address.

### How does CFnew handle the ALPN parameter in VLESS links?

When the `alpn` parameter is present, CFnew splits the comma-separated string into an array, trims whitespace from each protocol identifier, and filters out empty strings. This produces a clean array compatible with Clash's ALPN configuration requirements, such as `["h2", "http/1.1"]`.

### Does CFnew support Encrypted Client Hello (ECH) for VLESS connections?

Yes. When the `ech` query parameter is present in the VLESS link, CFnew enables ECH by setting `node['ech-opts'].enable` to `true` and defaulting the query server name to `cloudflare-ech.com` unless a custom domain is specified in the configuration.