search

YunoHost-Apps / searxng_ynh

Searxng package for YunoHost
https://docs.searxng.org/
Other
14 stars 5 forks source link

Add as search engine doesn’t work #91

Closed pagiraud closed 4 months ago

pagiraud commented 1 year ago

Describe the bug

SearxNG can’t be set as a search engine using Open Search (tested with Firefox).

Context

Steps to reproduce

Expected behavior

The engine is added. Since this works with https://searx.be and there is nothing related in the upstream repository, I think this is related to the Yunohost configuration. What is strange is that I didn’t see any difference in the source codes of the Open Search plugins…

Searx.be : 

<?xml version="1.0" encoding="utf-8"?>
<OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/" xmlns:moz="http://www.mozilla.org/2006/browser/search/">
  <ShortName>Searx Belgium</ShortName>
  <LongName>SearXNG metasearch</LongName>
  <Description>SearXNG is a metasearch engine that respects your privacy.</Description>
  <InputEncoding>UTF-8</InputEncoding>
  <Image type="image/png">https://searx.be/static/themes/simple/img/favicon.png</Image>
  <Url rel="results" type="text/html" method="POST" template="https://searx.be/search">
    <Param name="q" value="{searchTerms}" />
  </Url>
    <Url rel="suggestions" type="application/x-suggestions+json" method="POST" template="https://searx.be/autocompleter?q={searchTerms}"/>
  <Url rel="self" type="application/opensearchdescription+xml"  method="POST" template="/opensearch.xml?method=POST&amp;autocomplete=google" />
  <Query role="example" searchTerms="SearXNG" />
  <moz:SearchForm>https://searx.be/search</moz:SearchForm>
</OpenSearchDescription>

Mine:

<?xml version="1.0" encoding="utf-8"?>
<OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/" xmlns:moz="http://www.mozilla.org/2006/browser/search/">
  <ShortName>SearXNG - my.domain</ShortName>
  <LongName>SearXNG metasearch</LongName>
  <Description>SearXNG is a metasearch engine that respects your privacy.</Description>
  <InputEncoding>UTF-8</InputEncoding>
  <Image type="image/png">https://my.domain/searxng/static/themes/simple/img/favicon.png</Image>
  <Url rel="results" type="text/html" method="POST" template="https://my.domain/searxng/search">
    <Param name="q" value="{searchTerms}" />
  </Url>
    <Url rel="suggestions" type="application/x-suggestions+json" method="POST" template="https://my.domain/searxng/autocompleter?q={searchTerms}"/>
  <Url rel="self" type="application/opensearchdescription+xml"  method="POST" template="/searxng/opensearch.xml?method=POST&amp;autocomplete=duckduckgo" />
  <Query role="example" searchTerms="SearXNG" />
  <moz:SearchForm>https://my.domain/searxng/search</moz:SearchForm>
</OpenSearchDescription>

Any idea?

Cheers,

pagiraud commented 1 year ago

Ok, I found the origin. Adding the Open Search plugin doesn’t work if the application is not available to visitors. So I allowed visitors, added the plugin, and restricted again to all Yunohost users. The plugin works fine. Do you think there would be a way around so that the plugin can be added even if the application access is restricted to Yunohost users ?

mh4ckt3mh4ckt1c4s commented 1 year ago

Hello @pagiraud, Sorry for the late reply, I took time to test your issue and try to find a solution. Sadly, after some debugging on Firefox, it seems that all of the OpenSearch integration is built without support for authentication or cookies. That's why the "add as search engine" feature is failing, because Firefox is not sending the SSOWAT cookies when querying the opensearch.xml file, and end up being redirected by SSOWAT.

I think there is no other solution than adding the search engine with the method you described. If you really want / need that feature without deactivating and reactivating the visitors restriction, you either need to use something else than cookie authentication (such as putting SearXNG behind a VPN) or to write an issue to Firefox and ask them to add authentication support into OpenSearch.

To go further on the "modifying Firefox" solution, you would need to save lifetime credentials / cookies when adding the search engine, which can be seen as a security risk to generate and use those, and I'm not even sure that SSOWAT supports those. Furthermore, using cookies when adding a search engine can be more difficult than it appears because Firefox have no way to know which cookies are useful to access the search engine.

Finally, I found out that adding the search engine is not the only problem you will stumble upon when using SearXNG : for example, the autocomplete and search suggestion used by Firefox if this SearXNG is your default engine won't be authenticated too and will repeatedly hit your SearXNG instance uselessly. There may be other situations where this kind of problem arise.

Feel free to keep me informed of the solution you choose and things you tried. It was an interesting problem to work on and I may write the issue to Firefox myself if I found some time and motivation.

Aeris1One commented 1 year ago

There's already a bugzilla report since Firefox 76 : https://bugzilla.mozilla.org/show_bug.cgi?id=1624457

supermamie commented 1 year ago

Maybe a few URIs can be added in another permission group ? (like the opensearch.xml and maybe the autocompletion ?) I am not sure about the autocompletion and any API in fact, because maybe it will trigger searchs.

But at least for the opensearch.xml, it should be possible to set it as public.

mh4ckt3mh4ckt1c4s commented 12 months ago

Indeed, opensearsearch.xml can be made public to make adding the search engine possible. For the autocomplete part it is more complicated as the autocomplete endpoint is nearly the same as the search one, so allowing one while restricting the other would be too complex to handle.

ewilly commented 4 months ago

Can't reproduce it Feel fre to ask to comment in that ticket if it's not solved on your side