[Bug]: PasarGuard generates sessionPlacement instead of sessionIdPlacement for XHTTP subscriptions

[M-A-M-B-A]

Before you submit

• I searched existing issues and did not find the same problem.
• I am using the latest available PasarGuard version, or I included the exact version below.

PasarGuard version

Latest

Installation type

Docker Compose

What happened?

PasarGuard generates an XHTTP client configuration using

"sessionPlacement": "query"

instead of

"sessionIdPlacement": "query"

Since Xray-core v26.7.11, this difference is important because of the fix introduced in commit 1aabe7e for Issue #6410:

XTLS/Xray-core@1aabe7e
XTLS/Xray-core#6410

The Xray fix preserves file-like paths (for example /hls/stream.m3u8) only when both sessionIdPlacement and seqPlacement are outside the URL path.

Because PasarGuard still generates sessionPlacement, Xray treats the Session ID as if it were path-based and normalizes the configured path to:

/hls/stream.m3u8/

instead of

/hls/stream.m3u8

This prevents users from benefiting from the Xray fix and causes problems when using CDN fronting.

Steps to reproduce

Install the latest PasarGuard.
Configure an XHTTP inbound with:
path: /hls/stream.m3u8
Session ID placement set to Query.
Generate a subscription.
Import the subscription into an Xray client running v26.7.11 or newer.
Inspect the generated configuration.

Generated by PasarGuard:

"extra": {
"sessionPlacement": "query",
"seqPlacement": "query"
}

Expected:

"extra": {
"sessionIdPlacement": "query",
"seqPlacement": "query"
}

Expected behavior

PasarGuard should generate

"sessionIdPlacement": "query"

instead of

"sessionPlacement": "query"

when creating subscriptions for Xray-core v26.7.11+.

This allows Xray to correctly recognize that Session ID is placed outside the URL path, preserve file-like paths such as

/hls/stream.m3u8

without appending a trailing slash, and fully benefit from the fix introduced in Xray commit 1aabe7e (Issue #6410).

Logs and error messages

Server log:

transport/internet/splithttp: failed to validate path,
request:/hls/stream.m3u8,
config:/hls/stream.m3u8/

If the path is requested directly without the trailing slash:

https://example.com/hls/stream.m3u8

the request reaches the origin.

If the path contains the trailing slash:

https://example.com/hls/stream.m3u8/

the CDN returns HTTP 403 Forbidden.

Environment

OS: Ubuntu 24.04 LTS PasarGuard: latest Xray-core: v26.7.11 Browser: N/A Reverse proxy: nginx CDN: Beget CDN Transport: XHTTP

Relevant configuration

Screenshots or videos

No response

Additional context

No response