can1357/oh-my-pi · error · Error

SearXNG Basic auth username cannot contain ':' because RFC 7

Error message

SearXNG Basic auth username cannot contain ':' because RFC 7617 uses it as the separator.

What it means

The configured SearXNG Basic auth username contains a colon. RFC 7617 encodes credentials as "username:password", so a colon in the username makes the credential string ambiguous and cannot be encoded correctly; findAuth rejects it with a plain Error.

Source

Thrown at packages/coding-agent/src/web/search/providers/searxng.ts:158

}

/** RFC 7617 forbids C0 and C1 control characters in Basic auth credentials. */
function hasControlCharacters(value: string): boolean {
	return /[\u0000-\u001F\u007F-\u009F]/u.test(value);
}

/** Find SearXNG authentication from settings or environment. Basic auth takes precedence over bearer tokens. */
function findAuth(): SearXNGAuth | null {
	const basicUsername = findBasicUsername();
	const basicPassword = findBasicPassword();
	if (basicUsername !== null || basicPassword !== null) {
		if (basicUsername === null || basicPassword === null) {
			throw new Error(
				"SearXNG Basic auth requires both searxng.basicUsername and searxng.basicPassword, or SEARXNG_BASIC_USERNAME and SEARXNG_BASIC_PASSWORD.",
			);
		}
		if (basicUsername.includes(":")) {
			throw new Error("SearXNG Basic auth username cannot contain ':' because RFC 7617 uses it as the separator.");
		}
		if (hasControlCharacters(basicUsername) || hasControlCharacters(basicPassword)) {
			throw new Error("SearXNG Basic auth credentials must not contain RFC 7617 control characters.");
		}
		return { type: "basic", value: buildBasicAuthValue(basicUsername, basicPassword) };
	}

	const token = findToken();
	return token ? { type: "bearer", value: token } : null;
}

/** Find configured engine names/shortcuts from settings. */
function findEngines(): string | null {
	try {
		const engines = settings.get("searxng.engines");
		if (engines) return engines;
	} catch {
		// Settings not initialized yet

View on GitHub (pinned to 9690622007)

Solutions

1. Move the password portion into searxng.basicPassword / SEARXNG_BASIC_PASSWORD and keep only the username part in the username field
2. If the SearXNG account genuinely has a colon in its username, switch to bearer-token auth instead of Basic
3. Check for accidental paste of a combined credential string or curl-style -u user:pass value

Example fix

// before
SEARXNG_BASIC_USERNAME=alice:s3cret
// after
SEARXNG_BASIC_USERNAME=alice
SEARXNG_BASIC_PASSWORD=s3cret

const u = process.env.SEARXNG_BASIC_USERNAME;
if (u !== undefined && u.includes(":")) {
  throw new Error('SEARXNG_BASIC_USERNAME must not contain ":"; put the password in SEARXNG_BASIC_PASSWORD');
}

try {
  const auth = searxngAuth();
} catch (err) {
  if (err instanceof Error && err.message.includes("cannot contain ':'")) {
    // split the combined value into username/password fields
  }
  throw err;
}

When it happens

Trigger: findAuth resolves a basicUsername (from searxng.basicUsername or SEARXNG_BASIC_USERNAME) whose value includes ":" and passes the completeness check.

Common situations: User pasted "username:password" into the username field, or used an email-like/URI-style username containing a colon.

Related errors

• SearXNG Basic auth requires both searxng.basicUsername and s
• OMP_AUTH_BROKER_ACCOUNT_POOL_FILE contains an empty provider
• OMP_AUTH_BROKER_ACCOUNT_POOL_FILE contains a provider id wit
• No credential with id=${id}
• ${name} path does not exist: ${trimmed}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/67607ff1500ebfc2. Report an issue: GitHub.