What is a PAC file?
A PAC file (Proxy Auto-Configuration) is a configuration file that uses a JavaScript function to decide, for each destination URL, whether traffic is routed directly or through a proxy. At its core is the function FindProxyForURL(url, host), which the browser and operating system evaluate for every request; the result is an instruction such as PROXY host:port or DIRECT. In a Zscaler environment, PAC files control which traffic goes to the Zscaler cloud for inspection and which bypasses it. They look unremarkable, but they are a central control point for traffic forwarding: an error in the PAC logic hits many users at once, and shows up as "the internet is broken" or as uninspected traffic.
PAC file in detail
Technically, a PAC file is a small script that the client loads from a URL and evaluates locally. The logic typically checks hostnames, domains or IP ranges and returns the first matching instruction. Zscaler provides hosted PAC files that can be maintained centrally and can contain variables through which the client automatically gets the nearest Zscaler node, such as ${GATEWAY} for the currently reachable gateway IP, or ${Gateway_Host} for a hostname instead of a fixed IP address.
Together with the Zscaler Client Connector, the PAC shows up in two places: the forwarding profile can wrap traffic in tunnel mode or point it to the proxy through a PAC, and the app profile can also hold PAC-based rules and exceptions. Important for troubleshooting: a PAC only controls applications that respect the system's or browser's proxy settings. Traffic from services that bypass those settings follows other paths, such as the tunnel.
Why PAC files matter in Zscaler operations
In operations, the PAC file is a classic lever with a wide blast radius: a typo, a wrongly ordered condition or a forgotten exception hits every user loading that PAC immediately. Typical ticket patterns are "everything is slow", "site unreachable", or applications that only work at certain locations. Whether the PAC, the forwarding profile or the network is behind it is hard to tell without visibility into the chain.
On the security side: every DIRECT exception is traffic that bypasses inspection. PAC files that have grown over years accumulate exceptions whose reason nobody remembers any more. That is why PAC changes belong under version control, with a stated reason and testing, and a regular look at which exceptions are still needed. For audits, what counts is who changed the file, when, and why.
Common sources of error
- Syntax or logic errors: even a single typo in the PAC function can break forwarding for every user who loads the file.
- DIRECT exceptions too broad: whatever goes direct is not inspected; exception lists that have grown over time become an invisible security hole.
- Local copies and caches: outdated, locally distributed PAC versions instead of the centrally hosted file lead to drift and hard-to-reproduce errors.
- PAC confused with tunnel mode: expecting the PAC to control all traffic overlooks applications that ignore proxy settings.
PAC files in practice: what CentaurNexus contributes
CentaurNexus looks exactly where guesswork usually starts: inside the PAC itself. What this live check of the active PAC file looks like in practice, using a test URL, is shown in our roughly two-and-a-half-minute video. PAC-Lens reads the actual, active PAC file straight from the tenant, checks its syntax, and shows through a test URL which line in FindProxyForURL applies, before anyone blames the PAC on a hunch. For changes, PAC Configuration Studio adds a build side alongside the read side: PAC rules are put together in a rule builder with no JavaScript knowledge needed, the Testing tab checks them with the same trace engine as PAC-Lens, and the finished file is exported; uploading it into the tenant deliberately stays with the admin. Whether a fault actually sits in forwarding at all is settled upfront by Connectivity Triage Map, with a plain-language finding: ISP, Wi-Fi, device or Zscaler. The following guide shows what that triage looks like day to day: Is it Zscaler or the Wi-Fi?.
Related terms
Frequently asked questions about PAC files
A PAC file contains JavaScript with the function FindProxyForURL(url, host). It checks conditions such as hostnames, domains or IP ranges, and returns how the request should be routed: through a specific proxy (PROXY host:port) or directly (DIRECT). The browser and operating system evaluate this function for every request.
DIRECT tells the client to connect straight to the destination without a proxy. In security terms, that means this traffic bypasses inspection. DIRECT exceptions are sometimes necessary, for example for local destinations, but should be kept small, justified and reviewed regularly.
Depending on configuration, the Client Connector uses PAC logic in both the forwarding profile and the app profile, for example to direct traffic to the Zscaler cloud or to reflect exceptions. Whether traffic is routed through the tunnel or through a PAC depends on the mode chosen; Zscaler documents the details in the Help Portal.
Centrally hosted PAC files make sure every client loads the same version, and changes take effect everywhere at once. Local copies go stale unnoticed and produce hard-to-reproduce errors. Central files can also be versioned and changed under control, which matters for troubleshooting and for evidence.
The first places to check are the proxy settings of the operating system and browser, and the active profile of the Zscaler Client Connector. That is where the URL the PAC loads from is recorded. For diagnosis, it is worth checking: is it the expected URL, and does the content match the centrally maintained version?
- Zscaler Help Portal: ZIA documentation, help.zscaler.com/zia
- Zscaler Help Portal: Writing a PAC File - help.zscaler.com/zia/writing-pac-file
- Zscaler Help Portal: About Forwarding Profiles - help.zscaler.com/zscaler-client-connector/about-forwarding-profiles
Note: CentaurNexus is an independent product of SourcingBlox GmbH and not an offering of Zscaler, Inc. Product and brand names belong to their respective owners.