invalid SearXNG base_url: must be an absolute http(s) URL

Error message

invalid SearXNG base_url: must be an absolute http(s) URL

What it means

The provided SearXNG base_url is not an absolute http(s) URL: url.Parse failed, or the parsed URL has no scheme or no host. The function demands a fully qualified absolute URL before applying further scheme and SSRF checks.

Source

Thrown at internal/infrastructure/web_search/searxng.go:47

// to the SSRF_WHITELIST environment variable.
type SearxngProvider struct {
	client           *http.Client
	baseURL          string
	lastUnresponsive [][]string
}

// ValidateSearxngBaseURL validates a SearXNG instance URL: must be a non-empty,
// absolute http(s) URL, and must pass the SSRF whitelist check. Shared between
// the service-layer parameter validation and the provider constructor so that
// "save" and "use" never disagree.
func ValidateSearxngBaseURL(rawURL string) error {
	base := strings.TrimSpace(rawURL)
	if base == "" {
		return fmt.Errorf("base_url is required for SearXNG provider")
	}
	parsed, err := url.Parse(base)
	if err != nil || parsed.Scheme == "" || parsed.Host == "" {
		return fmt.Errorf("invalid SearXNG base_url: must be an absolute http(s) URL")
	}
	if parsed.Scheme != "http" && parsed.Scheme != "https" {
		return fmt.Errorf("invalid SearXNG base_url scheme: %s", parsed.Scheme)
	}
	if parsed.RawQuery != "" || parsed.Fragment != "" {
		return fmt.Errorf("invalid SearXNG base_url: must not contain query or fragment")
	}
	if err := utils.ValidateURLForSSRF(base); err != nil {
		return fmt.Errorf("invalid SearXNG base_url: %w", err)
	}
	return nil
}

// NewSearxngProvider builds a SearXNG provider from tenant parameters.
func NewSearxngProvider(params types.WebSearchProviderParameters) (interfaces.WebSearchProvider, error) {
	base := strings.TrimSpace(params.BaseURL)
	if err := ValidateSearxngBaseURL(base); err != nil {
		return nil, err

View on GitHub (pinned to 988cbb0330)

Solutions

Prepend the scheme: "searx.example.com" -> "https://searx.example.com"
Ensure both scheme and host exist (e.g. not just "https://")
Validate with url.Parse in a quick snippet before saving config
Use the full instance URL including base path if any, e.g. https://host/searxng

Example fix

// before
baseURL := "searx.example.com"
// after
baseURL := "https://searx.example.com"

Defensive patterns

Strategy: validation

Validate before calling

u, err := url.Parse(baseURL)
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("base_url must be absolute, e.g. https://searx.example.com (got %q)", baseURL)
}

Try / catch

if err := web_search.ValidateSearxngBaseURL(cfg.BaseURL); err != nil {
    if strings.Contains(err.Error(), "absolute http(s) URL") {
        return fmt.Errorf("fix base_url: prepend https:// to the host")
    }
    return err
}

Prevention

Always enter the full URL including scheme in config/UI
Auto-prepend https:// when the user supplies a bare hostname (with confirmation)
Validate URLs at save time, not at request time
Reject relative paths early in config parsing

When it happens

Trigger: NewSearxngProvider or the save-validation path receives base_url values like "localhost:8080/searxng", "searx.example.com", or a malformed URL that url.Parse cannot handle.

Common situations: Users omitting the https:// prefix, relative paths pasted from docs, DNS-only names without scheme, URLs copied with missing characters.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/8778e89da6aefd92. Report an issue: GitHub.