What is Proxy Auto-Config?

What is Proxy Auto-Config?

Proxy Auto-Config (PAC) is a standardized method for automatically configuring web client proxy settings. Rather than manually specifying proxy server addresses in browser settings, PAC allows administrators to deploy a single configuration file that clients download and execute to determine which proxy (if any) should be used for each web request. This approach simplifies large-scale proxy management and enables dynamic proxy selection based on sophisticated rules.

How Proxy Auto-Config Works

When a client is configured to use PAC, the following process occurs:

1. The client browser or application requests the PAC file from a designated URL (typically http://wpad/wpad.dat or a manually configured location)
2. The client downloads the JavaScript file and caches it locally
3. For each HTTP/HTTPS request, the client executes the JavaScript function FindProxyForURL(url, host)
4. The function analyzes the destination URL and hostname, applying logic rules defined by the administrator
5. The function returns a proxy directive string (e.g., PROXY proxy1.company.com:8080 or DIRECT)
6. The client either routes traffic through the specified proxy or connects directly

PAC File Structure and JavaScript

A PAC file is a plain-text JavaScript file containing helper functions and the mandatory FindProxyForURL(url, host) function. The file must define this function with the following signature:

function FindProxyForURL(url, host) { ... }

Common helper functions provided by PAC include:

• isPlainHostname(host) — determines if hostname contains no dots
• dnsDomainIs(host, domain) — matches domain names
• localHostOrDomainIs(host, hostdom) — checks if host is local or in specified domain
• isResolvable(host) — attempts DNS resolution
• isInNet(host, ipaddr, mask) — checks if IP address is in subnet
• shExpMatch(str, shexp) — shell-style pattern matching
• weekdayRange(day1, day2) — evaluates weekday-based rules
• dateRange() — evaluates date-based rules
• timeRange() — evaluates time-based rules

Return Values and Proxy Directives

The FindProxyForURL() function must return a string specifying proxy behavior:

• DIRECT — connect directly without a proxy
• PROXY host:port — route through specified proxy server
• SOCKS host:port — route through SOCKS proxy
• SOCKS5 host:port — route through SOCKS5 proxy
• Multiple directives separated by semicolons for failover (e.g., PROXY proxy1:8080; PROXY proxy2:8080; DIRECT)

Configuration Methods

Manual Configuration: Users or administrators explicitly specify the PAC file URL in browser settings (typically under Proxy Settings or Network Configuration).

WPAD (Web Proxy Auto-Discovery): Clients automatically discover the PAC file location using DHCP or DNS queries without manual configuration. Clients search for wpad.company.com or request a DHCP option 252 that contains the PAC URL.

Group Policy (Windows): Administrators deploy PAC settings through Active Directory Group Policy Objects to managed network computers.

Mobile Device Management (MDM): Organizations push PAC configuration to mobile devices through MDM platforms.

Common Use Cases

Geographic Routing: Route users in different offices through their local proxy servers based on DNS domain or IP address ranges.

Application-Specific Proxying: Use different proxies for internal applications versus internet access.

Conditional Access Control: Bypass proxies for trusted internal domains while routing external traffic through security appliances.

Load Balancing: Distribute proxy traffic across multiple proxy servers using failover logic.

Compliance and Monitoring: Route all web traffic through inspection proxies for security and compliance purposes.

Bandwidth Management: Apply time-based rules to use different proxies during peak hours.

Key Advantages

• Centralized Management: Administrators modify proxy behavior from a single file rather than configuring each client individually
• Dynamic Configuration: Logic-based rules enable sophisticated proxy selection without client updates
• Automatic Discovery: WPAD eliminates manual configuration in large organizations
• Failover Support: Multiple proxy specifications enable redundancy and load balancing
• Platform Independence: PAC works across Windows, macOS, Linux, and most browsers
• Reduced Administrative Overhead: Changes propagate automatically without touching individual devices

Limitations and Considerations

Security: PAC files are downloaded and executed as JavaScript, creating potential security risks if the distribution source is compromised. Always serve PAC files over HTTPS when possible.

Performance: Executing JavaScript logic for every HTTP request can introduce latency, particularly with complex rules or slow DNS resolution.

WPAD Vulnerabilities: Automatic WPAD discovery can be exploited through DNS spoofing or DHCP attacks. Consider disabling automatic WPAD in security-sensitive environments.

Limited to Web Traffic: PAC only affects HTTP/HTTPS traffic in browsers; non-browser applications may not support PAC.

Caching Issues: Browser caching of PAC files can prevent updates from taking effect immediately.

Debugging Complexity: Testing and troubleshooting PAC logic can be challenging without proper logging and monitoring.

HTTPS Limitations: Some helper functions like isResolvable() may perform DNS lookups that can be slow or impossible in filtered networks.

PAC File Example

The following example shows a simple PAC file that routes internal traffic directly and external traffic through a proxy:

function FindProxyForURL(url, host) {
if (dnsDomainIs(host, "company.local") || dnsDomainIs(host, ".company.com")) {
return "DIRECT";
}
if (isPlainHostname(host)) {
return "DIRECT";
}
return "PROXY proxy.company.com:8080; DIRECT";
}

Best Practices

• Version Control: Maintain PAC files in version control with documentation of rule changes
• Security: Serve PAC files over HTTPS and validate their integrity
• Testing: Test PAC rules in staging environments before production deployment
• Monitoring: Log and monitor proxy selection to detect configuration issues
• Simplicity: Keep rules simple and efficient to minimize client-side performance impact
• Documentation: Document the purpose of each rule for future maintenance
• Redundancy: Include multiple proxy servers in return statements for failover capability
• Caching Control: Consider PAC file cache-control headers to balance update frequency and client load

PAC vs. Manual Proxy Configuration

While manual proxy configuration requires each client to be individually configured with specific proxy addresses, PAC enables administrators to implement complex, dynamic routing logic in a single file. This makes PAC significantly more scalable for enterprise environments with hundreds or thousands of clients.

Modern Alternatives and Evolution

While PAC remains widely used, some organizations are transitioning to newer technologies such as HTTPS proxies with CONNECT method support and cloud-based proxy selection mechanisms. However, PAC remains the de facto standard for automatic proxy configuration across browsers and operating systems.