searxng/searx/flaskfix.py, branch master

[fix] replace X-Scheme by X-Forwarded-Proto header (#5107)

2025-08-10T11:05:40Z

The HTTP X-Forwarded-Proto (XFP) request header is a *de-facto* standard header for identifying the protocol (HTTP or HTTPS) that a client used to connect to a proxy or load balancer.[1] The ``X-Scheme`` header was added 10 years ago, why ``X-Scheme`` was used back then and not ``X-Forwarded-Proto``, nobody knows today / possibly because ``X-Forwarded-Proto`` wasn't a *de-facto* standard back then. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto [2] https://github.com/searx/searx/commit/6ef7c3276

[fix] use X-Forwarded-Proto header if the URL scheme is unknown (#5106)

2025-08-10T09:08:57Z

The HTTP X-Forwarded-Proto (XFP) request header is a de-facto standard header for identifying the protocol (HTTP or HTTPS) that a client used to connect to a proxy or load balancer.[1] In our documentation[2] we recommend to set the `X-Scheme` header. This header is not required if the `server.base_url` is set correctly.[3] If none of these URL scheme details exist, then the header X-Forwarded-Proto is evaluated as a third alternative. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-Proto [2] https://docs.searxng.org/admin/installation-apache.html#apache-s-searxng-site [3] https://docs.searxng.org/admin/settings/settings_server.html Closes: https://github.com/searxng/searxng/issues/5105

[mod] limiter: trusted proxies (#4911)

2025-08-09T21:03:30Z

Replaces `x_for` functionality with `trusted_proxies`. This allows defining which IP / ranges to trust extracting the client IP address from X-Forwarded-For and X-Real-IP headers. We don't know if the proxy chain will give us the proper client address (REMOTE_ADDR in the WSGI environment), so we rely on reading the headers of the proxy before SearXNG (if there is one, in that case it must be added to trusted_proxies) hoping it has done the proper checks. In case a proxy in the chain does not check the client address correctly, integrity is compromised and this should be fixed by whoever manages the proxy, not us. Closes: - https://github.com/searxng/searxng/issues/4940 - https://github.com/searxng/searxng/issues/4939 - https://github.com/searxng/searxng/issues/4907 - https://github.com/searxng/searxng/issues/3632 - https://github.com/searxng/searxng/issues/3191 - https://github.com/searxng/searxng/issues/1237 Related: - https://github.com/searxng/searxng-docker/issues/386 - https://github.com/inetol-infrastructure/searxng-container/issues/81

[mod] pylint all files with one profile / drop PYLINT_SEARXNG_DISABLE_OPTION

2024-03-11T13:55:38Z

In the past, some files were tested with the standard profile, others with a profile in which most of the messages were switched off ... some files were not checked at all. - ``PYLINT_SEARXNG_DISABLE_OPTION`` has been abolished - the distinction ``# lint: pylint`` is no longer necessary - the pylint tasks have been reduced from three to two 1. ./searx/engines -> lint engines with additional builtins 2. ./searx ./searxng_extra ./tests -> lint all other python files Signed-off-by: Markus Heiser

[format.python] initial formatting of the python code

2021-12-27T08:26:22Z

This patch was generated by black [1]:: make format.python [1] https://github.com/psf/black Signed-off-by: Markus Heiser

[pylint] searx: drop no longer needed 'missing-function-docstring'

2021-09-07T11:34:35Z

Suggested-by: @dalf https://github.com/searxng/searxng/issues/102#issuecomment-914168470 Signed-off-by: Markus Heiser

[mod] refactor: move Flask proxy fix to searx.flaskfix module

2021-06-08T13:54:11Z