PAC-K006 · https-proxy-keyword-without-fallback

HTTPS proxy keyword without a PROXY fallback

medium · Compatibility across engines

"HTTPS host:port" tells the browser to open TLS to the proxy itself. Chromium and Firefox support it; WinHTTP-based clients do not, and most on-premises proxies have no TLS listener. Without a PROXY fallback those clients end up without a proxy.

Why it matters

The HTTPS keyword is not “proxy for https traffic”; it means the client-to-proxy hop is TLS. It is correct for cloud gateways that terminate TLS on their listener and wrong for the typical enterprise forward proxy that accepts plain HTTP CONNECT. Engines that do not know the keyword drop the entry (PAC-E011). Two failure shapes follow: a WinHTTP client sees an empty list and goes DIRECT; a browser opens TLS to a proxy that speaks plain HTTP and the connection fails. If HTTPS is intended, keep a PROXY fallback in the same list for clients that cannot use it, and verify the proxy actually offers TLS.

How to fix

Use "PROXY host:port" for plain-HTTP proxies; for a TLS-terminating gateway write "HTTPS gw:443; PROXY gw:8080" so that other engines still get a proxy.

Examples

function FindProxyForURL(url, host) {
  return "HTTPS gateway.corp.example:443";
}

function FindProxyForURL(url, host) {
  return "HTTPS gateway.corp.example:443; PROXY gateway.corp.example:8080";
}

Engine behaviour

Source: code = read in the engine's source, doc = vendor documentation, lab = observed in a lab run, expert = practitioner knowledge, not yet verified.

Related rules

• Return value is not a valid proxy string PAC-E011
• SOCKS keywords mean different versions on different engines PAC-K005

References

• https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Proxy_servers_and_tunneling/Proxy_Auto-Configuration_PAC_file#return_value_format