What is Proxy Auto-Config (PAC)?
In the realm of networking and web scraping, Proxy Auto-Config (PAC) is the industry standard for simplifying proxy management across large fleets of devices. At its core, a PAC file is a simple text file containing a single JavaScript function: FindProxyForURL(url, host).
When a device with PAC enabled needs to make a request (e.g., fetching a webpage), it executes this JavaScript function locally. The function returns specific instructions telling the browser which gateway to use for that specific request. This moves the logic from static network settings to a dynamic, programmatic ruleset.
Why PAC Files Matter in 2025
For modern scraping operations and enterprise IT environments, static proxies are inefficient. If you rotate proxies or need to bypass geolocation blocks, updating thousands of bots or employee devices manually is impossible. PAC allows you to point every device to a single URL (the pac_file_url), and you control their behavior by editing that one file.
---
Technical Deep Dive: How PAC Works
The FindProxyForURL Function
The engine of a PAC file is the JavaScript function FindProxyForURL(url, host). The browser passes two arguments to this function: 1. url: The full URL of the destination object (e.g., https://www.example.com/data). 2. host: The hostname extracted from the URL (e.g., www.example.com).
The function must return a string specifying the proxy configuration. The valid return values are:
-
"DIRECT": Connect directly to the internet without a proxy. -
"PROXY host:port": Use the specified proxy server (e.g.,PROXY 192.168.1.1:8080). -
"SOCKS host:port": Use the specified SOCKS proxy. -
"HTTP host:port": Use the specified HTTP proxy.
You can combine these using a semicolon ; to provide fallback options. For example: "PROXY proxy1.example.com:8080; PROXY proxy2.example.com:8080; DIRECT"
This instruction tells the browser: "Try proxy 1. If it fails, try proxy 2. If that fails, go direct."
Helper Functions
The JavaScript implementation within a PAC file has access to a specific set of helper functions defined by the browser (usually based on the Netscape standard). These are critical for writing logic.
| Function | Description | Example Use Case | | :--- | :--- | :--- | | isPlainHostName(host) | Returns true if the hostname has no domain (dot). | Bypass proxy for local Intranet servers (http://intranet/). | | dnsDomainIs(host, domain) | Returns true if the host matches the domain. | Send all .gov traffic through a secure proxy. | | localHostOrDomainIs(host, hostdom) | Checks for exact local host match. | Handling local development servers. | | isResolvable(host) | Tries to resolve the hostname via DNS. | If DNS fails, go direct (to avoid proxy DNS timeouts). | | isInNet(host, pattern, mask) | Checks if an IP address matches a subnet mask. | Route traffic to internal 10.0.0.0/8 subnets directly. | | shExpMatch(str, pattern) | Shell expression pattern matching (wildcards). | Match URLs using wildcards like *.example.com. | | weekdayRange(wd1, wd2) | Checks if current time falls within weekday range. | Disable heavy proxy routing during weekends. | | timeRange(...) | Checks if current time falls within a specific hour range. | Load balancing: Route to Proxy A during business hours, Proxy B at night. |
---
Real-World Examples and Use Cases
Example 1: Basic Corporate Proxy PAC
This script sends all internal traffic directly (bypassing the proxy for speed and security) and sends all external internet traffic through a corporate proxy.
function FindProxyForURL(url, host) {
// If the hostname is just the machine name (no dots), connect direct if (isPlainHostName(host)) return "DIRECT";
// If host is part of the internal domain, connect direct if (dnsDomainIs(host, ".mycompany.local")) return "DIRECT";
// If IP address is in the private range (e.g., 192.168.x.x), connect direct if (isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0")) return "DIRECT";
// Everything else goes to the main corporate proxy return "PROXY proxy.mycompany.com:3128"; }
Example 2: High-Performance Rotating Proxy for Scraping
For advanced web scraping, you can use a PAC file to distribute requests across multiple proxy servers to prevent rate limiting. While a load balancer usually does this, a PAC file provides a "poor man's load balancer" or a way to segregate traffic based on the target domain.
function FindProxyForURL(url, host) {
// Define your pool of rotating residential proxies var proxy1 = "PROXY res-proxy-1.provider.io:8000"; var proxy2 = "PROXY res-proxy-2.provider.io:8000"; var direct = "DIRECT";
// Convert host to lowercase for consistency host = host.toLowerCase(); url = url.toLowerCase();
// Bypass proxy for non-target websites (ads, trackers) if (shExpMatch(url, "*google-analytics.com*")) return direct;
// Route specific difficult targets to Proxy 1 if (shExpMatch(host, "*.target-website-a.com")) { return proxy1 + "; " + direct; // Fallback to direct if proxy fails }
// Route other targets to Proxy 2 based on time of day (Load Balancing) var hour = weekdayRange("MON", "FRI"); // Logic to distribute load...
return proxy2; }
---
How to Find and Use PAC URLs on Different Devices
Since a PAC file is just a text file, it must be hosted on a web server reachable by your client devices. The URL typically looks like http://wpad.example.com/proxy.pac.
1. Finding PAC URL on macOS
If you are on a managed network (like office WiFi), macOS often downloads the PAC file automatically via WPAD (Web Proxy Autodiscovery Protocol). However, to find the specific URL: 1. Open System Settings > Network. 2. Select your active network service (Ethernet or Wi-Fi). 3. Click Details > Proxies. 4. Look at the "Automatic Proxy Configuration" checkbox. If checked, the URL field next to it contains your PAC URL (e.g., http://proxy.local/file.pac).
2. Configuring PAC on Android
Android handles PAC files slightly differently depending on the version and if the device is rooted or stock.
1. Long press your connected WiFi network. 2. Select Modify Network (or Network Details). 3. Show advanced options. 4. Under Proxy, select Auto-Config. 5. In the PAC URL field, enter the location of your script. Android will download and validate it immediately.
3. Using PAC Files in Python (Requests)
If you are building a scraper, standard Python libraries like requests do not natively interpret PAC files (they don't have a JS engine built-in). To use a PAC file in Python, you typically need to parse it or use a library that handles the proxy resolution for you.
While pypac exists, a robust 2025 approach often involves using a headless browser or resolving the proxy *before* running the request.
However, if you know the PAC file logic implies that google.com goes through a specific proxy, you manually configure it. For a truly dynamic approach using a PAC file in Python, you would extract the proxy logic:
import requests
from pypac import PACSession, get_pac
This is a conceptual example using a PAC-resolving library
Initialize a session that uses the PAC file
try: # Option 1: Point to the PAC URL pac = get_pac(url='http://wpad.example.com/proxy.pac') session = PACSession(pac)
# The session now automatically checks the PAC file for every domain response = session.get('http://example.com') print(f"Response Status: {response.status_code}")
except Exception as e: # Fallback to direct if PAC fails print(f"PAC Resolution failed: {e}") session = requests.Session() response = session.get('http://example.com')
4. Troubleshooting: The file:// vs http:// Trap
When configuring PAC locally (e.g., for testing), you might be tempted to use file:///C:/Users/Name/proxy.pac.
file:// for security reasons.Best Practice: Always host your PAC file on an internal HTTP(S) server. This ensures all devices, regardless of OS, can fetch the configuration.
---
WPAD: The "Invisible" PAC
You often hear about PAC in the context of WPAD (Web Proxy Autodiscovery Protocol). This is a method by which web browsers automatically discover a PAC file without you manually typing in the URL.
1. The browser attempts to download http://wpad/wpad.dat from the local network. 2. If that fails, it tries to resolve the host wpad via DNS.
In enterprise environments, WPAD is used to ensure that no device is left unconfigured. However, in scraping, understanding WPAD is crucial because if your scraping node accidentally connects to a network with WPAD enabled, your scraper might unknowingly route traffic through a corporate proxy, getting your IP banned immediately.
---
Conclusion: Is PAC Right for You?
For the average home user, Proxy Auto-Config is invisible. But for SysAdmins and Web Scraping Experts, PAC files are a powerful tool.
For any infrastructure managing more than 10 IPs or a complex mix of whitelisted and blacklisted domains, PAC is the industry standard.