# Browser or Node.js objects used in the PAC

Source: https://findproxyforurl.net/rules/browser-or-node-objects-in-pac/ · updated 2026-10-12

Changed 2026-10-12: console now has its own rule, because it works in Chrome and current pactester builds but not on Windows or in older pactester builds; the earlier statement that Chrome does not define console was wrong. The new rule for window, navigator, fetch, setTimeout, process, require and similar objects now counts in the rating, because no engine defines them.

Rule PAC-E018 (`browser-or-node-objects-in-pac`), severity high, category: Errors and robustness.

A PAC file runs neither in a web page nor in Node.js. window, document, navigator, fetch, setTimeout, process, require and similar objects are not defined, so using them throws an error and the browser treats the file as broken.

## Why it matters

PAC code runs in a small JavaScript context that has the ECMAScript built-ins (String, Array,
Math and so on) and the PAC helper functions, nothing else. Objects from a web page, such as
`window`, `document`, `navigator`, `localStorage`, `XMLHttpRequest`, `fetch`, `setTimeout` and
`setInterval`, do not exist there. The same holds for the Node.js objects `process`, `require`,
`module`, `exports`, `global` and `Buffer`: a file that reads environment variables through
`process` or calls `require()` fails before it returns anything.

Using one of these names throws a ReferenceError ("x is not defined"), which has the same effect
as any other exception (PAC-E006): the request is handled as a script failure. In the lab,
Chrome 145 and pactester 1.4.6 and 1.5.3 had no `window`, `setTimeout` or `fetch`, and Windows
(WinHTTP, Windows 11) had no `window` or `navigator`.

`console` is a special case: some engines define it and some do not. PAC-K022 covers it.


## How to fix

Remove window, document, navigator, fetch, setTimeout, process and require references. Decide on url and host only, and test the file with a separate test tool.

## Bad

```js
function FindProxyForURL(url, host) {
  if (navigator.userAgent.indexOf("Firefox") >= 0) {
    return "DIRECT";
  }
  return "PROXY proxy.corp.example:8080";
}
```

## Good

```js
function FindProxyForURL(url, host) {
  return "PROXY proxy.corp.example:8080";
}
```

## Engine behaviour

- chromium: window, setTimeout and fetch are undefined in the PAC context; using them throws. (source: lab, verified 2026-10-04)
- pacparser: window, setTimeout and fetch are undefined in 1.4.6 and 1.5.3; using them throws. (source: lab, verified 2026-10-04)
- winhttp: window and navigator are undefined; using them throws. (source: lab, verified 2026-10-11)