Comments on: SuperPAC Hell

Question: SuperPAC Hell

bfranklin — Thu, 18 Oct 2012 13:06:58 -0800

Why is Safari on an iPad running iOS 5.1 ignoring my PAC file for https URLs?

iPad running iOS 5.1. PAC file is correctly formatted. As a test case, I've even configured the PAC to simply return "PROXY myproxy.com:port";, no dice.

The PAC file works just fine when I install it on my browser. Syntax checking says it's fine. Manually configuring the proxy for this network to be myproxy.com:9080 makes everything work perfectly, but the PAC for some reason will not function as expected.

I'm at my wits end with this one. Google is awash with people at .edu's whining about apple and very little technical details. Help me askmefi, you're my only hope!

By: k5.user

k5.user — Thu, 18 Oct 2012 13:25:43 -0800

My initial thought was, you can't proxy https.

Googling seems to confirm this pretty clearly. eg StackOverflow

By: bfranklin

bfranklin — Thu, 18 Oct 2012 13:30:29 -0800

Saw that stack overflow answer. The reason given is technically incorrect, and as stated, HTTPS proxies just fine via manual configuration. This is specific to using a PAC.

By: bfranklin

bfranklin — Thu, 18 Oct 2012 13:50:45 -0800

And I should clarify, by technically incorrect, I mean incorrect for myriad technical reasons. That accepted answer on stack overflow is just plain wrong.

By: McCoy Pauley

McCoy Pauley — Thu, 18 Oct 2012 14:20:21 -0800

The StackOverflow answer is indeed nonsense -- that's what the CONNECT method in HTTP is for. The proxy can't decrypt or modify the HTTPS traffic that it's proxying, but it's entirely capable of simply handing it along.

Can you post your PAC file for us, sanitized of private IPs/hostnames if need be? Otherwise its harder to tell what might be going wrong.

By: bfranklin

bfranklin — Thu, 18 Oct 2012 17:33:45 -0800

McCoy Pauley: In my simplest test case, it's:

function FindProxyForURL(url, host) { return "PROXY proxy.mydomain.com:9080"; }