How is a PAC file consumed?

Web browsers are configured to look for and read the PAC file each time the browser is started, or at regular intervals when pushed by a Group Policy Object (GPO).

When a URL request is made, the browser calls the FindProxyForURL(url, host) function to determine the request’s routing disposition (to a proxy or direct to the destination).

Although the PAC file can be placed on each individual client machine, this is an uncommon and inefficient approach. The common arrangement is to host the PAC file on a server that all clients have access to. In smaller deployments, the Content Gateway host system can be used. In large enterprises the PAC file should be hosted on an existing (dedicated) web server that all clients have access to. Alternatively, the

Web Proxy Auto-discovery Protocol (WPAD) can be used to assist browsers in locating and retrieving the WPAD file, which contains the PAC function definition. WPAD not an option with the Forcepoint Web Security Hybrid Module; see Using a PAC file with Forcepoint Web Security and the Forcepoint Web Security Hybrid Module, below.

Note: Internet Explorer includes a feature called Automatic Proxy Result Cache. This feature can cause problems in environments that use a PAC file and have multiple proxy servers. See What is Internet Explorer Automatic Proxy Result Cache?