<html><body><div style="font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style="font-family:'arial' , 'helvetica' , sans-serif;font-size:12pt;color:#000000"><div>>> uri_whitespace encode<br>><br>>Hmm. Accepting whitespace in URLs is a risky choice. One can never be<br>>completely sure how third-party agents in the network are handling it<br>>before the request arrived.<br>><br>>If (big IF) you are able to use "uri_whitespace deny" this proxy would<br>>be a bit more secure. This is just a suggestion, you know best here.<br></div><br><div>I think that was a workaround for a vulnerability. If it was, it may no longer be needed.<br></div><br><div><br>><br>>> acl trellix_phone_cloud dstdomain amcore-ens.rest.gti.trellix.com<br>>> http_access deny trellix_phone_cloud<br>>> external_acl_type host_based_filter children-max=15 ttl=0 0X0P+0CL >> acl HostBasedRules external host_based_filter<br>>> http_access allow HostBasedRules<br>>> auth_param digest program /usr/lib/squid/digest_file_auth -c /etc/squid/passwd<br>>> auth_param digest realm squid<br>>> auth_param digest children 2<br>>> auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/basic_passwd<br>>> auth_param basic children 2<br>>> auth_param basic realm squidb<br>>> auth_param basic credentialsttl 2 hours<br>><br>>> acl auth_users proxy_auth REQUIRED<br>>> external_acl_type custom_acl_db children-max=15 ttl=0 0X0P+0CL >> acl CustomAclDB external custom_acl_db<br>>> http_access allow CustomAclDB<br>><br>><br>>Hmm, this use of combined authentication+authorization is a bit tricky<br>>with two layers of asynchronous helper lookups going on. That alone<br>>might be what is going on with the weird 403's.<br>><br>><br>>A better sequence would be:<br>><br>># ensure login is performed<br>>http_access deny !auth_users<br>><br>># check the access permissions for whichever user logged in<br>>http_access allow CustomAclDB<br><br></div><br><div>The first call the the external_acl is to process unauthenticated requests. Is the suggestion to replace<br></div><br><div> acl auth_users proxy_auth REQUIRED </div><br><div>with <br></div><br><div> http_access deny !auth_users </div><br><div>before the second external_acl (for authenticated requests)?<br></div><br><br><br><br><div>Thanks again, very much<br></div><br><br><div>Kevin<br></div></div><br></div></div></body></html>