# PAC URL asks for a login

Source: https://findproxyforurl.net/rules/pac-needs-authentication/ · last updated 2026-10-13

Rule PAC-D012 (`pac-needs-authentication`), severity high, category: Delivery (HTTP headers).

The PAC URL answers with a login challenge (401 or 407, Basic, NTLM, Negotiate). Chrome, Edge and Windows do not log in to fetch a PAC file, so they run without one.

## Why it matters

The PAC file is fetched before the client knows which proxy to use, often before the user has
signed in, and by system services that have no user to ask. Clients therefore fetch it without
credentials. Chromium cancels the download as soon as the server asks for a login. In the lab,
Windows (WinHTTP) failed on both a Basic and an NTLM login request (error 12015). Firefox shows
a login dialog for the PAC URL, which users do not expect and often cannot answer.

This usually happens when the PAC file sits behind a single sign-on web server, a reverse proxy
that protects everything, or a proxy that requires a login and also serves the PAC file. A PAC
file contains no secrets that a login would protect: it only lists proxies and host names. Serve
it anonymously.


## How to fix

Exempt the PAC URL (and wpad.dat) from authentication on the web server or proxy that serves it.

## Bad

```js
HTTP/1.1 401 Unauthorized
WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate
```

## Good

```js
HTTP/1.1 200 OK
Content-Type: application/x-ns-proxy-autoconfig
Cache-Control: max-age=3600
```

## Engine behaviour

- chromium: When the server asks for a login, the PAC download is cancelled; no PAC is used. (source: code, verified 2026-10-13)
- firefox: The PAC download can show the normal login dialog; without an answer the PAC is not loaded. (source: code, verified 2026-10-13)
- winhttp: A 401 answer with a Basic or an NTLM login request failed (error 12015); no PAC was used. (source: lab, verified 2026-10-11)