diff --git a/proxy/vmess/encoding/server.go b/proxy/vmess/encoding/server.go
index eb7d90c1184..6e6a5e4bf43 100644
--- a/proxy/vmess/encoding/server.go
+++ b/proxy/vmess/encoding/server.go
@@ -155,7 +155,7 @@ func (s *ServerSession) DecodeRequestHeader(reader io.Reader) (*protocol.Request
 
 	user, timestamp, valid := s.userValidator.Get(buffer.Bytes())
 	if !valid {
-		return nil, newError("invalid user")
+		return nil, drainConnection(newError("invalid user"))
 	}
 
 	iv := hashTimestamp(md5.New(), timestamp)
diff --git a/testing/scenarios/command_test.go b/testing/scenarios/command_test.go
index ace50ca0ff5..bce0bfafff9 100644
--- a/testing/scenarios/command_test.go
+++ b/testing/scenarios/command_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"strings"
 	"testing"
 	"time"
 
@@ -265,7 +266,9 @@ func TestCommanderAddRemoveUser(t *testing.T) {
 	common.Must(err)
 	defer CloseAllServers(servers)
 
-	if err := testTCPConn(clientPort, 1024, time.Second*5)(); err != io.EOF {
+	if err := testTCPConn(clientPort, 1024, time.Second*5)(); err != io.EOF &&
+		/*We might wish to drain the connection*/
+		(err != nil && !strings.HasSuffix(err.Error(), "i/o timeout")) {
 		t.Fatal("expected error: ", err)
 	}