# Server compresses the PAC file although the client did not ask

Source: https://findproxyforurl.net/rules/pac-compressed-unasked/ · last updated 2026-10-13

Rule PAC-D014 (`pac-compressed-unasked`), severity high, category: Delivery (HTTP headers).

The server compresses the PAC file even for a request that did not ask for compression. Such a server compresses for every client, and Windows (WinHTTP) could not load a compressed PAC file in the lab.

## Why it matters

A client says which compression it understands in the `Accept-Encoding` request header, and a
correctly configured web server compresses only when that header allows it. The diagnosis
script fetches the PAC file without that header, on purpose. If the answer still carries
`Content-Encoding: gzip` (or another method), the server compresses unconditionally: a
hand-written header, a precompressed file served as-is, or a CDN or load balancer rule.

In the lab, Windows (WinHTTP) could not load a PAC file that the server always sent
gzip-compressed (error 12166), so every Windows program behaved as if there were no PAC file.
Browsers that ask for compression are not affected, which is why this is easy to miss.
Compression itself is fine (PAC-D006) as long as the server only uses it when asked.

This rule can only fire when it is known that the request did not ask for compression: from the
diagnosis script, or from `curl -v` output that shows the request headers. Plain `curl -sI`
output does not show what was sent.


## How to fix

Let the web server compress only for requests that carry Accept-Encoding gzip (mod_deflate, nginx gzip on, both default to this) and add Vary Accept-Encoding; remove any fixed Content-Encoding header for .pac and .dat.

## Bad

```js
> GET /proxy.pac HTTP/1.1
> (no Accept-Encoding header)
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig
Content-Encoding: gzip
```

## Good

```js
> GET /proxy.pac HTTP/1.1
> (no Accept-Encoding header)
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig
Vary: Accept-Encoding
```

## Engine behaviour

- winhttp: A PAC file that the server always sent gzip-compressed failed to load (error 12166); no PAC was used. (source: lab, verified 2026-10-11)