WPAD

WPAD, the Web Proxy Auto-Discovery Protocol, is a system that allows clients such as web browsers to automatically locate a PAC (Proxy Auto-Config) file and determine how to route their HTTP requests through a proxy. It was defined in RFC 3084 and is used especially in large or managed networks to simplify proxy configuration for many machines.

WPAD relies on two discovery mechanisms: DNS and DHCP. In the DNS method, the client looks up a host named wpad in its DNS domain, typically obtaining a URL like http://wpad.example.com/wpad.dat. In the DHCP method, network administrators can supply the PAC file location via DHCP option 252. The PAC file itself is a JavaScript file that must expose a FindProxyForURL(url, host) function, which returns a string describing which proxies to use (for example, "PROXY proxy.example.com:8080" or "DIRECT" to bypass the proxy).

The typical discovery order is to attempt DNS first, then DHCP, though implementations may vary. The PAC file is usually served at the path /wpad.dat from the wpad host, over HTTP or HTTPS, with the returned data guiding the client’s proxy usage.

Security and privacy considerations are important with WPAD. Because WPAD can be affected by rogue DHCP or DNS configurations, an attacker on the local network can redirect traffic through an attacker-controlled proxy, enabling interception or modification of requests. Mitigations include disabling WPAD in untrusted networks, auditing DHCP and DNS configurations, and, where feasible, enforcing manual proxy settings or using trusted PAC sources and secure transport for PAC delivery.