How CFnew Parses VLESS Protocol Headers: Complete Technical Guide

CFnew parses VLESS protocol headers by treating share-links as standard URLs and extracting fields using the native URL and URLSearchParams APIs within the parseLinkToClashNode function located in the 明文源吗 source file.

CFnew, developed by byJoey, is a Cloudflare Worker-based subscription converter that transforms proxy share-links into client-compatible configurations. Understanding how CFnew parses VLESS protocol headers reveals the internal mechanics of modern proxy link parsing and the standardized approach to extracting transport-layer parameters from VLESS URLs according to RFC 3986.

VLESS Parsing Architecture in CFnew

The parsing logic resides in 明文源吗 (the plain-source worker file), specifically within the parseLinkToClashNode function spanning lines 1542–1590. Rather than implementing fragile regex-based extraction, CFnew leverages the JavaScript URL constructor and URLSearchParams interface to destructure VLESS links into their constituent components.

Step-by-Step VLESS Parsing Implementation

URL Object Initialization and Core Field Extraction

When a link begins with vless://, the parser immediately instantiates a URL object:

const url = new URL(link);

This operation provides structured access to all URI components. The function extracts core identity fields directly from URL properties:

• UUID: Retrieved from url.username (the userinfo portion of the URI)
• Server: Extracted via url.hostname, supporting IPv4, IPv6, and domain names
• Port: Parsed as an integer with fallback logic—parseInt(url.port) || 443—defaulting to 443 when unspecified
• Node Name: Decoded from the fragment identifier using decodeURIComponent(url.hash.substring(1))

Query Parameter Processing with URLSearchParams

Transport and security parameters reside in the query string, processed via:

const params = new URLSearchParams(url.search);

Key VLESS parameters extracted include:

• Security/TLS: Determined by evaluating params.get('security') === 'tls' || params.get('tls') === 'true'
• Transport Type: Defaults to WebSocket (ws) via params.get('type') || 'ws'
• WebSocket Path: Defaults to /?ed=2048 if params.get('path') is absent
• HTTP Host: Falls back to the server address via params.get('host') || server
• SNI (Server Name Indication): Defaults to the host value via params.get('sni') || host
• ALPN: Split into an array when present using alpnRaw.split(',').map(a => a.trim()).filter(Boolean)
• Client Fingerprint: Defaults to "chrome" when the fp or client-fingerprint parameter is unavailable

TLS and Security Parameter Handling

When TLS is enabled, the node object receives additional cryptographic configuration:

node.servername = servername;
node.alpn = alpnRaw.split(',').map(a => a.trim()).filter(Boolean);
node['skip-cert-verify'] = false;

The servername parameter prioritizes explicit SNI values over inferred hostnames, ensuring proper TLS handshake behavior in environments with strict certificate validation.

WebSocket Transport Configuration

For WebSocket-based transports (network === 'ws'), CFnew constructs dedicated options:

node['ws-opts'] = {
  path,
  headers: { Host: host },
};

This structure maps directly to Clash/Meta configuration specifications, preserving the HTTP Host header integrity required for CDN-backed VLESS endpoints.

Encrypted Client Hello (ECH) Support

Modern privacy features are supported through the ech query parameter. When present, CFnew injects ECH configuration:

node['ech-opts'] = {
  enable: true,
  'query-server-name': customECHDomain || 'cloudflare-ech.com',
};

This enables Encrypted Client Hello functionality, defaulting to Cloudflare's ECH infrastructure when no custom domain is specified.

Complete Node Construction Example

The following example demonstrates the complete parsing flow for a standard VLESS link:

// Example VLESS share-link
const vlessLink = 'vless://01234567-89ab-cdef-0123-456789abcdef@myserver.example.com:443?security=tls&type=ws&path=%2F?ed%3D2048&host=myserver.example.com&sni=myserver.example.com&alpn=h2,http/1.1&fp=chrome#My-Node';

// CFnew internal parsing
const node = parseLinkToClashNode(vlessLink);

The resulting node object conforms to the following structure:

{
  "name": "My-Node",
  "type": "vless",
  "server": "myserver.example.com",
  "port": 443,
  "uuid": "01234567-89ab-cdef-0123-456789abcdef",
  "tls": true,
  "network": "ws",
  "client-fingerprint": "chrome",
  "servername": "myserver.example.com",
  "alpn": ["h2", "http/1.1"],
  "skip-cert-verify": false,
  "ws-opts": {
    "path": "/?ed=2048",
    "headers": { "Host": "myserver.example.com" }
  }
}

Summary

• CFnew implements VLESS parsing in the parseLinkToClashNode function within 明文源吗 (lines 1542–1590), utilizing standard web platform APIs rather than regex-based extraction.
• Core fields (UUID, server, port, name) are extracted from the URL object properties (username, hostname, port, hash).
• Transport parameters (WebSocket path, host, security type) are parsed via URLSearchParams with sensible defaults: network defaults to ws, path to /?ed=2048, and fingerprint to chrome.
• TLS configuration includes SNI derivation, ALPN array splitting, and strict certificate verification (skip-cert-verify: false).
• ECH support is triggered by the ech query parameter, enabling modern privacy extensions with Cloudflare-compatible defaults.

Frequently Asked Questions

Where is the VLESS parsing logic located in the CFnew repository?

The VLESS parsing implementation resides in the 明文源吗 file within the parseLinkToClashNode function, specifically between lines 1542 and 1590 according to the byJoey/cfnew source code. This single function handles the transformation from VLESS share-link to Clash-compatible node object.

What default values does CFnew use for VLESS parameters?

CFnew applies several defaults when parsing VLESS links: port defaults to 443, transport type (network) defaults to ws (WebSocket), WebSocket path defaults to /?ed=2048, and client fingerprint defaults to chrome. The SNI field defaults to the host parameter, which itself defaults to the server address.

How does CFnew handle the ALPN parameter in VLESS links?

When the alpn parameter is present, CFnew splits the comma-separated string into an array, trims whitespace from each protocol identifier, and filters out empty strings. This produces a clean array compatible with Clash's ALPN configuration requirements, such as ["h2", "http/1.1"].

Does CFnew support Encrypted Client Hello (ECH) for VLESS connections?

Yes. When the ech query parameter is present in the VLESS link, CFnew enables ECH by setting node['ech-opts'].enable to true and defaulting the query server name to cloudflare-ech.com unless a custom domain is specified in the configuration.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}