# Decision depends on the URL path or query

Source: https://findproxyforurl.net/rules/url-path-decision/ · updated 2026-10-11

Changed 2026-10-11: The rating now follows the Windows lab results of 2026-10-11: syntax newer than ES2017, such as ?. and ??, caps the grade at D, let and const only lower the score, and dateRange, timeRange, lower-case weekday names, decisions by URL path, SOCKS keywords, regex characters in shExpMatch and UTF-16 files are flagged.

Rule PAC-K021 (`url-path-decision`), severity info, category: Compatibility across engines.

The file chooses the route by the path or query of the URL. Chrome and Windows pass https URLs without path and query and Firefox passes no path at all, so such a test does not match there; Windows also reuses an earlier answer for the same host, even for http.

## Why it matters

The `url` argument holds the whole address of the request, for example
`http://intranet.example/app/start?id=1`. The part after the host name is the path
(`/app/start`) and the query (`?id=1`). A PAC file that chooses a proxy by that part is
fragile for two reasons.

For https addresses the path and query are private. Chrome (since version 52) passes only
`https://host/` to the PAC file, and in the lab on Windows 11 (2026-10-11) Windows did the
same (`https://host:port/`). Firefox goes further and removes path and query from every
address, http as well, unless a preference is changed. A test such as
`shExpMatch(url, "*/app/*")` is therefore never true for an https request in those clients,
and in Firefox never true at all.

For http addresses Windows keeps answers for a while. In the same lab run, later http
requests to the same host, even with another path or another port, got the answer that the
file had given for an earlier request; the file was not asked again. So the route that a
path asks for is not reliable on Windows even without https.

The finding is information only and does not change the grade, because some deployments rely
on path rules on purpose for http traffic in browsers. Choosing the route by host name is
the reliable form; rules by path belong on the proxy, which sees the whole request.


## How to fix

Decide by host (dnsDomainIs, shExpMatch(host, ...)) in the PAC file and move rules that need the path or query to the proxy.

## Bad

```js
function FindProxyForURL(url, host) {
  if (shExpMatch(url, "*/download/*")) {
    return "PROXY download-proxy.corp.example:8080";
  }
  return "PROXY proxy.corp.example:8080";
}
```

## Good

```js
function FindProxyForURL(url, host) {
  if (dnsDomainIs(host, ".download.corp.example")) {
    return "PROXY download-proxy.corp.example:8080";
  }
  return "PROXY proxy.corp.example:8080";
}
```

## Engine behaviour

- chromium: Since Chrome 52, https URLs reach the PAC file cut to scheme, host and port (SanitizeUrl); path and query are removed. (source: code, verified 2026-10-04)
- firefox: Path and query are removed for every scheme, not only https (preference network.proxy.autoconfig_url.include_path, default false). (source: code, verified 2026-10-04)
- winhttp: https URLs reach the script as https://host:port/. http URLs reach it whole, but later requests to the same host and scheme, also with another path or port, got an answer that the script had given for an earlier request. (source: lab, verified 2026-10-11)