Browser proxy settings and PAC rules
A browser does more than store one proxy address. For each URL it performs proxy resolution and chooses a direct connection or one of the configured intermediaries. The decision can come from system settings, manual rules, a PAC file, or auto-discovery. One working site therefore does not prove that every request follows the same route.
Key points in one minute
- Proxy selection is performed for each URL.
- PAC returns an ordered proxy list or DIRECT.
- Bypass rules can intentionally route some requests directly.
- A browser setting does not guarantee proxying for every system process.
Configuration sources
Depending on platform, Chromium can use system settings, command flags, enterprise policies, or PAC. Record the active source before troubleshooting. Editing one UI has no effect when a higher-priority policy supplies a different configuration.
PAC logic
A PAC file contains FindProxyForURL, which returns a sequence based on URL and host. The browser processes that sequence under its proxy rules. Keep PAC code simple, predictable, and versioned as production network configuration.
Bypass and DIRECT
A bypass match or DIRECT result sends the request without the selected proxy. This is useful for internal business resources, but an overly broad pattern creates an unintended direct path. Test changes against a defined set of internal and external URLs.
Browser authentication
When the proxy returns 407, the browser may show a dialog or use a managed credential provider. A website cannot arbitrarily set forbidden Proxy headers through ordinary JavaScript fetch. Configure credentials in a trusted browser or operating-system context.
Chrome has specific SOCKS5 limits: it does not support SOCKS5 authentication methods, performs SOCKS5 name resolution through the proxy, and applies SOCKS only to TCP-based URL requests. A username/password SOCKS5 endpoint is therefore not a universal manual Chrome configuration; verify compatibility in the chosen client documentation.
Practical checklist
- 1Identify the browser's active configuration source.
- 2Test HTTP, HTTPS, and SOCKS rules separately.
- 3Validate bypass and DIRECT against a URL test set.
- 4Do not store a clear-text password inside PAC.
- 5Reload configuration and verify the route after changes.
Sources and documentation
This material is based on primary, official, and technical sources. The article is an original summary written for this knowledge base.