Proxy auto-configuration (PAC) – Forcepoint
Standard (account-wide) PAC file URL (found on the Web > General page). This URL is an account-wide PAC file URL. This fetches a policy-specific PAC file on connections from recognized IP addresses, and the standard, global PAC file from unrecognized addresses.
Policy-specific PAC file URL (found on the General tab of a policy). This URL includes a policy identifier, which ensures that the PAC file specific to the policy is always retrieved. This can be useful to ensure that remote users always get the PAC file for a particular policy.
Note
If you have already deployed a standard cloud PAC file that uses a different URL than the one displayed on the page, there is no need to change it unless you wish to. PAC file URLs provided with earlier versions of your web product will continue to work.
Here, xxxxxx is a unique identifier for your policy.
Your Policy Specific PAC File Address is shown on your policy’s General tab. To access this screen, go to the Web > Policy Management > Policies page, then click the name of the policy.
Important
There is a security implication related to the use of PAC files. If someone could guess your unique policy identifier and download it, that person would know what sites were not protected by the cloud service and could, in theory, use them as an attack vector. To prevent this, PAC file identifiers are generated as non-sequential alphanumeric strings. Users cannot assume that the number on either side of their PAC file identifier is valid.
For additional security, use the HTTPS PAC file URL. Forcepoint also recommends disabling the Automatically detect settings option in your LAN automatic configuration settings.
Proxy auto-configuration (PAC) – Forcepoint
Standard (account-wide) PAC file URL (found on the Web > General page). This URL is an account-wide PAC file URL. This fetches a policy-specific PAC file on connections from recognized IP addresses, and the standard, global PAC file from unrecognized addresses.
Policy-specific PAC file URL (found on the General tab of a policy). This URL includes a policy identifier, which ensures that the PAC file specific to the policy is always retrieved. This can be useful to ensure that remote users always get the PAC file for a particular policy.
Note
If you have already deployed a standard cloud PAC file that uses a different URL than the one displayed on the page, there is no need to change it unless you wish to. PAC file URLs provided with earlier versions of your web product will continue to work.
Here, xxxxxx is a unique identifier for your policy.
Your Policy Specific PAC File Address is shown on your policy’s General tab. To access this screen, go to the Web > Policy Management > Policies page, then click the name of the policy.
Important
There is a security implication related to the use of PAC files. If someone could guess your unique policy identifier and download it, that person would know what sites were not protected by the cloud service and could, in theory, use them as an attack vector. To prevent this, PAC file identifiers are generated as non-sequential alphanumeric strings. Users cannot assume that the number on either side of their PAC file identifier is valid.
For additional security, use the HTTPS PAC file URL. Forcepoint also recommends disabling the Automatically detect settings option in your LAN automatic configuration settings.
Proxy auto-config – Wikipedia
This article is about the browser file. For other uses, see PAC.
A proxy auto-config (PAC) file defines how web browsers and other user agents can automatically choose the appropriate proxy server (access method) for fetching a given URL.
A PAC file contains a JavaScript function FindProxyForURL(url, host). This function returns a string with one or more access method specifications. These specifications cause the user agent to use a particular proxy server or to connect directly.
Multiple specifications provide a fall-back when a proxy fails to respond. The browser fetches this PAC file before requesting other URLs. The URL of the PAC file is either configured manually or determined automatically by the Web Proxy Auto-Discovery Protocol.
Context[edit]
Modern web browsers implement several levels of automation; users can choose the level that is appropriate to their needs. The following methods are commonly implemented:
Automatic proxy selection: Specify a host-name and a port number to be used for all URLs. Most browsers allow you to specify a list of domains (such as localhost) that will bypass this proxy.
Proxy auto-configuration (PAC): Specify the URL for a PAC file with a JavaScript function that determines the appropriate proxy for each URL. This method is more suitable for laptop users who need several different proxy configurations, or complex corporate setups with many different proxies.
Web Proxy Auto-Discovery Protocol (WPAD): Let the browser guess the location of the PAC file through DHCP and DNS lookups.
History[edit]
The Proxy auto-config file format was originally designed by Netscape in 1996 for the Netscape Navigator 2. 0[1] and is a text file that defines at least one JavaScript function.
The PAC File[edit]
By convention, the PAC file is normally named The WPAD standard uses The file is expected to contain at least one function:
FindProxyForURL(url, host), with two arguments and return value in specific format:
* url is the URL of the object
* host is the host-name derived from that URL. Syntactically it is the same string as between and the first: or / after that. [2]
* return “… ” is a string of signatures in the following format (EBNF notation, see examples below):
returnValue = type host, “:”, port, [{ “;”, returnValue}];
type = “DIRECT” | “PROXY” | “SOCKS” | “HTTP” | “HTTPS” | “SOCKS4” | “SOCKS5″
host = UTF16String (* ECMA262-compatible UTF16 string *)
port = UTF16String (* Digits *)
To use it, a PAC file is published to a HTTP server, and client user agents are instructed to use it, either by entering the URL in the proxy connection settings of the browser or through the use of the WPAD protocol. The URL may also reference a local file as for example: file/etc/
Even though most clients will process the script regardless of the MIME type returned in the HTTP reply, for the sake of completeness and to maximize compatibility, the HTTP server should be configured to declare the MIME type of this file to be either application/x-ns-proxy-autoconfig or application/x-javascript-config.
There is little evidence to favor the use of one MIME type over the other. It would be, however, reasonable to assume that application/x-ns-proxy-autoconfig will be supported in more clients than application/x-javascript-config as it was defined in the original Netscape specification, the latter type coming into use more recently.
Example[edit]
A very simple example of a PAC file is:
function FindProxyForURL (url, host) {
return ‘PROXY; DIRECT’;}
This function instructs the browser to retrieve all pages through the proxy on port 8080 of the server Should this proxy fail to respond, the browser contacts the Web-site directly, without using a proxy. The latter may fail if firewalls, or other intermediary network devices, reject requests from sources other than the proxy—a common configuration in corporate networks.
A more complicated example demonstrates some available JavaScript functions to be used in the FindProxyForURL function:
// our local URLs from the domains below don’t need a proxy:
if (shExpMatch(host, ‘*. ‘)) {
return ‘DIRECT’;}
// URLs within this network are accessed through
// port 8080 on
if (isInNet(host, ’10. 0. 0′, ‘255. 255. 248. 0’)) {
return ‘PROXY ‘;}
// All other requests go through port 8080 of
// should that fail to respond, go directly to the WWW:
By default, the PROXY keyword means that a proxy corresponding to the protocol of the original request, be it,, or ftp, is used. Other supported keyword and proxy types include:
SOCKS
Use a SOCKS proxy.
HTTP, HTTPS
Introduced in more recent versions of Firefox. Specifies an HTTP(S) proxy.
SOCKS4, SOCKS5
Introduced in more recent versions of Firefox. Specifies the SOCKS protocol version.
Limitations[edit]
PAC Character-Encoding[edit]
The encoding of PAC scripts is generally unspecified, and different browsers and network stacks have different rules for how PAC scripts may be encoded. In general, wholly ASCII PAC scripts will work with any browser or network stack. Mozilla Firefox 66 and later additionally supports PAC scripts encoded as UTF-8. [3]
DnsResolve[edit]
The function dnsResolve (and similar other functions) performs a DNS lookup that can block the browser for a long time if the DNS server does not respond.
myIpAddress[edit]
The myIpAddress function has often been reported to give incorrect or unusable results, e. g. 192. 168. 1. 128, the IP address of the localhost.
It may help to remove on the system’s host file (e. /etc/hosts on Linux) any lines referring to the machine host-name, while the line 192. 1 localhost can, and should, stay. [citation needed]
Security[edit]
In 2013, researchers began warning about the security risks of proxy auto-config. [4] The threat involves using a PAC, discovered automatically by the system, to redirect the victim’s browser traffic to an attacker-controlled server instead.
Another issues about pac file is the typical implementation involve clear text retrieval, which does not include any security features such as code signing or web certificates. Attacker can perform man-in-middle spoofing attack easily.
Old Microsoft problems[edit]
Caching of proxy auto-configuration results by domain name in Microsoft’s Internet Explorer 5. 5 or newer limits the flexibility of the PAC standard. In effect, you can choose the proxy based on the domain name, but not on the path of the URL. Alternatively, you need to disable caching of proxy auto-configuration results by editing the registry, a process described by de Boyne Pollard (listed in further reading).
It is recommended to always use IP addresses instead of host domain names in the isInNet function for compatibility with other Windows components which make use of the Internet Explorer PAC configuration, such as 2. 0 Framework. For example,
if (isInNet(host, dnsResolve(sampledomain), ‘255. 0’)) {} // 2. 0 will resolve proxy properly
if (isInNet(host, sampledomain, ‘255. 0 will not resolve proxy properly
The current convention is to fail over to direct connection when a PAC file is unavailable.
Shortly after switching between network configurations (e. when entering or leaving a VPN), dnsResolve may give outdated results due to DNS caching.
For instance, Firefox usually keeps 20 domain entries cached for 60 seconds. This may be configured via the network. dnsCacheEntries and network. dnsCacheExpiration configuration variables. Flushing the system’s DNS cache may also help, which can be achieved e. in Linux with sudo service dns-clean start or in Windows with ipconfig /flushdns.
On Internet Explorer 9, isInNet(‘localHostName’, ”, ‘255. 255’) returns true and can be used as a workaround.
The myIpAddress function assumes that the device has a single IPv4 address. The results are undefined if the device has more than one IPv4 address or has IPv6 addresses.
Others[edit]
Further limitations are related to the JavaScript engine on the local machine.
Advanced functionality[edit]
More advanced PAC files can reduce load on proxies, perform load balancing, fail over, or even deny/allow listing before the request is sent through the network.
One can return multiple proxies:
return ‘PROXY; PROXY ‘;
The above will try proxy1 first and if unavailable it will then try proxy2.
References[edit]
^ “Navigator Proxy Auto-Config File Format”. Netscape Navigator Documentation. March 1996. Archived from the original on 2007-06-02. Retrieved 2013-07-05.
^ “Proxy Auto-Configuration (PAC) file – HTTP | MDN”.
^ “Bug 1492938 – Proxy autoconfig scripts should be loaded as UTF-8 if they are valid UTF-8, otherwise as Latin-1 (a byte is a code point)”. Retrieved 2019-04-10.
^ Lemos, Robert (2013-03-06). “Cybercriminals Likely To Expand Use Of Browser Proxies”. Retrieved 2016-04-20.
Further reading[edit]
de Boyne Pollard, Jonathan (2004). “Automatic proxy HTTP server configuration in web browsers”. Frequently Given Answers. Retrieved 2013-07-05.
External links[edit]
“Proxy Auto-Configuration (PAC) file”. 2019-01-27.
“Using the Client Autoconfiguration File”. Netscape Proxy Server Administrator’s Guide: Chapter 11. 1998-02-25. Archived from the original on 2004-08-10.
“Chapter 26 – Using Automatic Configuration, Automatic Proxy, and Automatic Detection”. Microsoft TechNet. Retrieved 2013-07-05.
“Proxy Auto Config for Firefox (PAC). Fully working examples including anti-ad and anti-adult filter rules”. 2012-05-12. Archived from the original on 2015-07-01. Retrieved 2009-05-24.
Frequently Asked Questions about pac url free
How do I get a pac URL?
PAC file addresses can be located on the Web > General page and on the General tab of a policy. In both locations, a default and alternate address is listed. Default PAC file address: the PAC file is retrieved over port 8082 by default, or 8087 for HTTPS.
What is pac URL?
A proxy auto-config (PAC) file defines how web browsers and other user agents can automatically choose the appropriate proxy server (access method) for fetching a given URL. … The URL of the PAC file is either configured manually or determined automatically by the Web Proxy Auto-Discovery Protocol.
How do I create a pac proxy?
Create the proxy. pac fileUsing a basic text editor, such as Notepad, create a file with the following content: function FindProxyForURL(url, host) { … Change host and domain name of the web proxy (the ” ws1100.example.com:8080 ” part) to match the Web Appliance’s configuration in your network. … Save this file as proxy.