PAC-D014 · pac-compressed-unasked

Server compresses the PAC file although the client did not ask

high · Delivery (HTTP headers)

The server compresses the PAC file even for a request that did not ask for compression. Such a server compresses for every client, and Windows (WinHTTP) could not load a compressed PAC file in the lab.

Why it matters

A client says which compression it understands in the Accept-Encoding request header, and a correctly configured web server compresses only when that header allows it. The diagnosis script fetches the PAC file without that header, on purpose. If the answer still carries Content-Encoding: gzip (or another method), the server compresses unconditionally: a hand-written header, a precompressed file served as-is, or a CDN or load balancer rule.

In the lab, Windows (WinHTTP) could not load a PAC file that the server always sent gzip-compressed (error 12166), so every Windows program behaved as if there were no PAC file. Browsers that ask for compression are not affected, which is why this is easy to miss. Compression itself is fine (PAC-D006) as long as the server only uses it when asked.

This rule can only fire when it is known that the request did not ask for compression: from the diagnosis script, or from curl -v output that shows the request headers. Plain curl -sI output does not show what was sent.

How to fix

Let the web server compress only for requests that carry Accept-Encoding gzip (mod_deflate, nginx gzip on, both default to this) and add Vary Accept-Encoding; remove any fixed Content-Encoding header for .pac and .dat.

Examples

> GET /proxy.pac HTTP/1.1
> (no Accept-Encoding header)
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig
Content-Encoding: gzip

> GET /proxy.pac HTTP/1.1
> (no Accept-Encoding header)
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig
Vary: Accept-Encoding

The difference is in what the request asked for; the same compressed answer is correct for a request with Accept-Encoding gzip.

Engine behaviour

Source: code = read in the engine's source, doc = vendor documentation, lab = observed in a lab run, expert = practitioner knowledge, not yet verified.

Related rules

• Large PAC served without compression PAC-D006
• PAC file is large PAC-P006

References

• https://www.rfc-editor.org/rfc/rfc9110#section-12.5.3