{"record":{"id":"67607ff1500ebfc2","repo":"can1357/oh-my-pi","slug":"searxng-basic-auth-username-cannot-contain-bec","errorCode":null,"errorMessage":"SearXNG Basic auth username cannot contain ':' because RFC 7617 uses it as the separator.","messagePattern":"SearXNG Basic auth username cannot contain ':' because RFC 7617 uses it as the separator\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/web/search/providers/searxng.ts","lineNumber":158,"sourceCode":"}\n\n/** RFC 7617 forbids C0 and C1 control characters in Basic auth credentials. */\nfunction hasControlCharacters(value: string): boolean {\n\treturn /[\\u0000-\\u001F\\u007F-\\u009F]/u.test(value);\n}\n\n/** Find SearXNG authentication from settings or environment. Basic auth takes precedence over bearer tokens. */\nfunction findAuth(): SearXNGAuth | null {\n\tconst basicUsername = findBasicUsername();\n\tconst basicPassword = findBasicPassword();\n\tif (basicUsername !== null || basicPassword !== null) {\n\t\tif (basicUsername === null || basicPassword === null) {\n\t\t\tthrow new Error(\n\t\t\t\t\"SearXNG Basic auth requires both searxng.basicUsername and searxng.basicPassword, or SEARXNG_BASIC_USERNAME and SEARXNG_BASIC_PASSWORD.\",\n\t\t\t);\n\t\t}\n\t\tif (basicUsername.includes(\":\")) {\n\t\t\tthrow new Error(\"SearXNG Basic auth username cannot contain ':' because RFC 7617 uses it as the separator.\");\n\t\t}\n\t\tif (hasControlCharacters(basicUsername) || hasControlCharacters(basicPassword)) {\n\t\t\tthrow new Error(\"SearXNG Basic auth credentials must not contain RFC 7617 control characters.\");\n\t\t}\n\t\treturn { type: \"basic\", value: buildBasicAuthValue(basicUsername, basicPassword) };\n\t}\n\n\tconst token = findToken();\n\treturn token ? { type: \"bearer\", value: token } : null;\n}\n\n/** Find configured engine names/shortcuts from settings. */\nfunction findEngines(): string | null {\n\ttry {\n\t\tconst engines = settings.get(\"searxng.engines\");\n\t\tif (engines) return engines;\n\t} catch {\n\t\t// Settings not initialized yet","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/web/search/providers/searxng.ts#L140-L176","documentation":"The configured SearXNG Basic auth username contains a colon. RFC 7617 encodes credentials as \"username:password\", so a colon in the username makes the credential string ambiguous and cannot be encoded correctly; findAuth rejects it with a plain Error.","triggerScenarios":"findAuth resolves a basicUsername (from searxng.basicUsername or SEARXNG_BASIC_USERNAME) whose value includes \":\" and passes the completeness check.","commonSituations":"User pasted \"username:password\" into the username field, or used an email-like/URI-style username containing a colon.","solutions":["Move the password portion into searxng.basicPassword / SEARXNG_BASIC_PASSWORD and keep only the username part in the username field","If the SearXNG account genuinely has a colon in its username, switch to bearer-token auth instead of Basic","Check for accidental paste of a combined credential string or curl-style -u user:pass value"],"exampleFix":"// before\nSEARXNG_BASIC_USERNAME=alice:s3cret\n// after\nSEARXNG_BASIC_USERNAME=alice\nSEARXNG_BASIC_PASSWORD=s3cret","handlingStrategy":"validation","validationCode":"const u = process.env.SEARXNG_BASIC_USERNAME;\nif (u !== undefined && u.includes(\":\")) {\n  throw new Error('SEARXNG_BASIC_USERNAME must not contain \":\"; put the password in SEARXNG_BASIC_PASSWORD');\n}","typeGuard":null,"tryCatchPattern":"try {\n  const auth = searxngAuth();\n} catch (err) {\n  if (err instanceof Error && err.message.includes(\"cannot contain ':'\")) {\n    // split the combined value into username/password fields\n  }\n  throw err;\n}","preventionTips":["Never paste 'user:pass' strings into the username field","Keep credentials in separate settings/env keys","Sanitize combined credential strings before saving config"],"tags":["configuration","auth","searxng","basic-auth","validation"],"backgroundTag":"invalid-credential-format","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}