ExamWizardzExamWizardz
Join waitlist
Networking

What is PAC?

Proxy Auto-Configuration (PAC) is a JavaScript-based specification that automatically determines the appropriate proxy server for a client to use when requesting web resources, eliminating the need for manual proxy configuration on individual devices.

Overview

Proxy Auto-Configuration (PAC) is a protocol and file format that enables web browsers and other HTTP clients to automatically discover and select the appropriate proxy server based on predefined rules and the target URL being accessed. Rather than requiring administrators to manually configure proxy settings on every client device, PAC uses a special JavaScript file to make intelligent routing decisions dynamically. This approach significantly reduces administrative overhead in enterprise environments while providing flexibility and centralized control over proxy policies.

How PAC Works

PAC operates through a JavaScript file (typically named proxy.pac) hosted on a web server that contains a single JavaScript function called FindProxyForURL(url, host). When a browser or client needs to access a web resource, it executes this JavaScript function, passing the target URL and hostname as parameters. The function evaluates the URL and hostname against predefined rules and returns a string specifying which proxy server (or direct connection) should be used for that particular request.

The browser downloads the PAC file once and caches it according to the configured refresh interval. The client-side JavaScript engine then executes the logic locally for each subsequent request, making routing decisions in real time without requiring communication back to the PAC server for every connection.

PAC File Structure and Syntax

A PAC file contains JavaScript code with specific structure and built-in utility functions. The basic format is:

function FindProxyForURL(url, host) { ... return proxystring; }

The return value can be:

  • DIRECT — Connect directly without using any proxy
  • PROXY host:port — Use the specified proxy server and port
  • SOCKS host:port — Use a SOCKS proxy server
  • SOCKS4 host:port — Use SOCKS4 protocol
  • SOCKS5 host:port — Use SOCKS5 protocol

PAC provides utility functions to simplify rule creation, including isPlainHostname(host), dnsDomainIs(host, domain), localHostOrDomainIs(host, hostdom), isResolvable(host), isInNet(host, ipaddr, mask), dnsResolve(host), convert_addr(ipaddr), isInNet(), and weekdayRange().

Configuration Methods

PAC files can be deployed through multiple configuration methods:

  1. Manual Browser Configuration: Users or administrators manually specify the PAC file URL in browser settings (e.g., http://intranet.company.com/proxy.pac)
  2. DHCP Configuration: DHCP servers can deliver the PAC file URL to clients via the DHCP option 252, enabling automatic discovery
  3. Web Proxy Auto-Discovery (WPAD): Clients automatically locate the PAC file using DHCP or DNS lookups for wpad.yourdomain.com
  4. Group Policy (Windows): System administrators deploy PAC configuration via Active Directory Group Policy Objects to managed Windows devices
  5. Mobile Device Management (MDM): Enterprise MDM solutions can distribute PAC settings to mobile and managed endpoints

Common Use Cases

PAC is widely used in enterprise environments for several important purposes:

  • Geolocation-Based Routing: Routes traffic through different proxies based on user location or originating IP address
  • Protocol-Based Routing: Directs HTTP, HTTPS, FTP, and other protocols through different proxies or directly
  • Domain-Based Routing: Sends traffic for specific domains or domain patterns to particular proxy servers
  • Time-Based Routing: Applies different proxy rules based on time of day or day of week
  • Failover and Load Balancing: Specifies multiple proxy servers with failover logic to balance load and ensure redundancy
  • Security and Content Filtering: Routes sensitive traffic through specific security appliances for inspection and filtering
  • Compliance and Monitoring: Enables organizations to ensure all internet traffic passes through authorized monitoring and compliance points

Security Considerations

While PAC offers significant administrative benefits, several security aspects require attention. PAC files should be delivered over HTTPS to prevent man-in-the-middle attacks and tampering. Organizations should digitally sign PAC files when possible. Administrators must carefully validate the JavaScript code within PAC files, as malicious scripts could be injected if the PAC file is compromised. Additionally, the isInNet() function performs DNS lookups, which can be exploited for DNS exfiltration attacks if not carefully managed. Organizations should implement access controls to restrict who can modify PAC files and maintain audit logs of changes.

Limitations and Challenges

Despite its benefits, PAC has several limitations. Not all applications support PAC — it is primarily effective with HTTP/HTTPS clients. Some modern browsers have reduced PAC support due to security concerns and performance impacts from executing arbitrary JavaScript. WPAD can be vulnerable to spoofing attacks if DNS or DHCP are compromised. Complex PAC logic can consume significant client-side resources and may slow down request processing. Debugging PAC files can be difficult, and JavaScript syntax errors may not be obvious to users. Additionally, PAC is not suitable for scenarios requiring dynamic, request-by-request decision making based on real-time server state.

Modern Alternatives and Evolution

Newer technologies complement or partially replace PAC functionality. The Web Proxy Auto-Discovery (WPAD) protocol automates PAC file discovery. Proxy Auto-Config (PAC) version 2.0 proposals have aimed to address limitations but never achieved standardization. Many organizations now use Secure Web Gateway (SWG) appliances and Zero Trust Network Access architectures that reduce reliance on traditional PAC-based proxy routing. Cloud-based proxy solutions increasingly use client agent software rather than traditional PAC files.

Best Practices

  • Keep PAC file logic simple and well-documented for maintainability
  • Test PAC files thoroughly before deployment to all users
  • Use HTTPS to deliver PAC files and implement access controls
  • Monitor PAC file refresh rates to balance freshness with server load
  • Implement fallback and failover logic for redundant proxy servers
  • Avoid expensive operations like dnsResolve() in frequently-called rules
  • Maintain version control and audit trails for PAC file changes
  • Consider complementary technologies like WPAD for automatic deployment
  • Regularly review and update PAC rules as network topology and security policies change

Studying for CompTIA (Networking)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, real PBQs, and a readiness score. Join the waitlist to be first in when CompTIA A+ launches.

← Back to the full CompTIA glossary