diff --git a/src/redir.c b/src/redir.c
index 607c890d..4c54c4ca 100644
--- a/src/redir.c
+++ b/src/redir.c
@@ -368,6 +368,13 @@ static void remote_send_cb(EV_P_ ev_io *w, int revents)
                        2);
             }
             addr_len += 2;
+
+            if (auth) {
+                ss_addr_to_send[0] |= ONETIMEAUTH_FLAG;
+                ss_onetimeauth(ss_addr_to_send + addr_len, ss_addr_to_send, addr_len);
+                addr_len += ONETIMEAUTH_BYTES;
+            }
+
             ss_addr_to_send = ss_encrypt(BUF_SIZE, ss_addr_to_send, &addr_len,
                                          server->e_ctx);
             if (ss_addr_to_send == NULL) {
@@ -377,12 +384,6 @@ static void remote_send_cb(EV_P_ ev_io *w, int revents)
                 return;
             }
 
-            if (auth) {
-                ss_addr_to_send[0] |= ONETIMEAUTH_FLAG;
-                ss_onetimeauth(ss_addr_to_send + addr_len, ss_addr_to_send, addr_len);
-                addr_len += ONETIMEAUTH_BYTES;
-            }
-
             int s = send(remote->fd, ss_addr_to_send, addr_len, 0);
             free(ss_addr_to_send);
 
diff --git a/src/tunnel.c b/src/tunnel.c
index b9c56135..c3dd2ca0 100644
--- a/src/tunnel.c
+++ b/src/tunnel.c
@@ -410,6 +410,12 @@ static void remote_send_cb(EV_P_ ev_io *w, int revents)
             memcpy(ss_addr_to_send + addr_len, &port, 2);
             addr_len += 2;
 
+            if (auth) {
+                ss_addr_to_send[0] |= ONETIMEAUTH_FLAG;
+                ss_onetimeauth(ss_addr_to_send + addr_len, ss_addr_to_send, addr_len);
+                addr_len += ONETIMEAUTH_BYTES;
+            }
+
             ss_addr_to_send = ss_encrypt(BUF_SIZE, ss_addr_to_send, &addr_len,
                                          server->e_ctx);
             if (ss_addr_to_send == NULL) {
@@ -419,12 +425,6 @@ static void remote_send_cb(EV_P_ ev_io *w, int revents)
                 return;
             }
 
-            if (auth) {
-                ss_addr_to_send[0] |= ONETIMEAUTH_FLAG;
-                ss_onetimeauth(ss_addr_to_send + addr_len, ss_addr_to_send, addr_len);
-                addr_len += ONETIMEAUTH_BYTES;
-            }
-
             int s = send(remote->fd, ss_addr_to_send, addr_len, 0);
             free(ss_addr_to_send);