security: remove hardcoded SearXNG secret key #22

Closed

eben-vranken wants to merge 2 commits from fix/app-api-privilege-escalation into main

eben-vranken commented

2026-05-31 17:49:58 +02:00

(Migrated from github.com)

Fix hardcoded SearXNG secret key

This PR fixes a security issue where the SearXNG secret_key was hardcoded to a static string in config/searxng/settings.yml and committed to the repo.

this is an actual security bug. SearXNG (which runs on Flask/Werkzeug) uses this exact key to cryptographically sign session cookies and generate CSRF tokens. Because this key is public in the codebase, the web framework's trust model is broken.

If this SearXNG instance is exposed to a network, anyone who knows this hardcoded string can generate valid cryptographic signatures. This means an attacker could completely bypass CSRF protections, or forge session cookies to aggressively alter user preferences (like forcing the instance to route searches to malicious upstream engines).

I updated the config to use the ${SEARXNG_SECRET} environment variable instead so it's safely injected at runtime.

Note: Going forward, you'll need to define SEARXNG_SECRET in your .env file or Docker setup. You can generate a random one using openssl rand -hex 32.

Fix hardcoded SearXNG secret key This PR fixes a security issue where the SearXNG `secret_key` was hardcoded to a static string in `config/searxng/settings.yml` and committed to the repo. this is an actual security bug. SearXNG (which runs on Flask/Werkzeug) uses this exact key to cryptographically sign session cookies and generate CSRF tokens. Because this key is public in the codebase, the web framework's trust model is broken. If this SearXNG instance is exposed to a network, anyone who knows this hardcoded string can generate valid cryptographic signatures. This means an attacker could completely bypass CSRF protections, or forge session cookies to aggressively alter user preferences (like forcing the instance to route searches to malicious upstream engines). I updated the config to use the `${SEARXNG_SECRET}` environment variable instead so it's safely injected at runtime. **Note:** Going forward, you'll need to define `SEARXNG_SECRET` in your `.env` file or Docker setup. You can generate a random one using `openssl rand -hex 32`.

👍 18

svin24 commented

2026-05-31 19:25:12 +02:00

(Migrated from github.com)

might be a good idea to add a note in the readme about that

❤️ 1

eben-vranken commented

2026-05-31 19:39:08 +02:00

(Migrated from github.com)

added!

pewdiepie-archdaemon commented

2026-06-01 04:03:23 +02:00

(Migrated from github.com)

Thanks. Fixed on main in 71d7429. The committed SearXNG settings file is now a template, and Docker creates /etc/searxng/settings.yml in the searxng-data volume using SEARXNG_SECRET when provided or a generated random secret on first boot. It also regenerates if it finds the old hardcoded key. Verified with a fresh SearXNG container: generated secret, healthy service, JSON search returned 200.

Thanks. Fixed on main in 71d7429. The committed SearXNG settings file is now a template, and Docker creates /etc/searxng/settings.yml in the searxng-data volume using SEARXNG_SECRET when provided or a generated random secret on first boot. It also regenerates if it finds the old hardcoded key. Verified with a fresh SearXNG container: generated secret, healthy service, JSON search returned 200.

❤️ 1