mirrors/searxng
1
0
Fork 0
mirror of https://github.com/searxng/searxng.git synced 2024-11-25 12:21:00 +00:00
Code Issues Projects Releases Wiki Activity

[mod] set HTTP GET method by default

Browse source 
HTTP GET vs POST
================

Already diskussed in "Method POST harms UX without providing a tangible privacy
benefit" [1].  At that time we agreed to POST.  However, as we are having more
and more drawbacks with POST, I suggest that we reconsider our previous
decision. The latest cause was [2], but we also have other problems that
negatively affect the UI [1]:

* Open Link in New Tab: does not work for our search result tabs because they
  aren't actual links.

* Bookmarking: a search becomes more difficult with POST. You cannot just press
  a browser keyboard shortcut `Ctrl+D` ... no you have to copy the Search URL from
  the sidebar. This can pose a real struggle for less technically-minded users.

* Sharing: a search with somebody else becomes more difficult with POST (for
  the same reason).

Lock HTTP method in the preferences
===================================

If the user changes the HTTP method in his settings, e.g. from GET to POST, but
has not removed the SearXNG instance from the WEB browser and added it again,
the WEB browser will continue to work with the old setting (GET), while entries
in the HTML form use the newly set method (POST). Not realted to this commit,
but this complication is also known from autocomplete[3].

Only very few maintainers are aware of this fact and probably none of the users
know about it.  We should provide a setup in our defaults that is manageable in
its entirety and comprehensible for the user.  For this reason, the option to
select the HTTP method in the preferences is also disabled in this commit.

[1] https://github.com/searxng/searxng/issues/711
[2] https://github.com/searxng/searxng/issues/3590
[3] https://github.com/searxng/searxng/pull/2333#issuecomment-1565392120

Closes: https://github.com/searxng/searxng/issues/3590
Signed-off-by: Markus Heiser <markus.heiser@darmarit.de>
This commit is contained in:
Markus Heiser 2024-06-28 14:47:22 +02:00
parent 46b9273352
commit ca85d20204
2 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
docs/admin/settings/settings_server.rst
View file

@ -14,6 +14,7 @@
limiter: false
public_instance: false
image_proxy: false
method: "GET"
default_http_headers:
X-Content-Type-Options : nosniff
X-Download-Options : noopen
@ -50,8 +51,14 @@
``image_proxy`` : ``$SEARXNG_IMAGE_PROXY``
Allow your instance of SearXNG of being able to proxy images. Uses memory space.
``method`` : ``GET`` | ``POST``
HTTP method. By defaults ``GET`` is used / The ``POST`` method has the
advantage with some WEB browsers that the history is not easy to read, but
there are also various disadvantages that sometimes severely restrict the ease
of use for the user (e.g. back button to jump back to the previous search
page and drag & drop of search term to new tabs do not work as expected).
.. _HTTP headers: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
``default_http_headers`` :
Set additional HTTP headers, see `#755 <https://github.com/searx/searx/issues/715>`__

8
searx/settings.yml
View file

@ -95,7 +95,7 @@ server:
http_protocol_version: "1.0"
# POST queries are more secure as they don't show up in history but may cause
# problems when using Firefox containers
method: "POST"
method: "GET"
default_http_headers:
X-Content-Type-Options: nosniff
X-Download-Options: noopen
@ -142,11 +142,11 @@ ui:
# Lock arbitrary settings on the preferences page. To find the ID of the user
# setting you want to lock, check the ID of the form on the page "preferences".
#
# preferences:
# lock:
preferences:
lock:
- method
# - language
# - autocomplete
# - method
# - query_in_title
# searx supports result proxification using an external service: