Home / server / Questions / 262962
Accepted
Majid Azimi
Asked: 2011-04-25 10:42:03 +0800 CST

squid - http_access

  • 772

There is a line in squid default configuration:

# Deny CONNECT to other than secure SSL ports
http_access deny CONNECT !SSL_ports

acls are applied from top down, so CONNECT acl will deny access to all non SSL and SSL ports. I mean it never reaches the second access rule.

squid access-control-list

1 Answers

  1. Best Answer

    CONNECT here means the HTTPS CONNECT method, i.e., the standardized way a browser talks to a proxy server, asking for a connection to an HTTPS-serving site

    http_access deny CONNECT !SSL_ports means 'deny all HTTPS CONNECT that asks to be connected to a port other than SSL_ports'. If the browser sends a CONNECT method asking to be connected to an SSL_port, the rule doesn't fire.

    Whether or not the CONNECT actually gets through depends on the successive http_access rules.

    • 1