Connect an ICAP HTML Response Service to Squid 7

For a Squid forward proxy that needs to transform an HTML response, use the adaptation path. Squid handles the browser's proxy request; an ICAP response service performs the body transformation and returns the adapted HTTP message.

This gives the transformation a defined place in the request lifecycle. A response header rule cannot replace an HTML parser, and a separate web-server filter does not automatically process traffic passing through Squid.

Connect a response service

For a Squid 7 build with ICAP support and an existing compatible service, the configuration shape is:

acl adaptation_clients src 192.0.2.0/24

icap_enable on
icap_service html_editor respmod_precache bypass=0 icap://127.0.0.1:1344/modify

adaptation_access html_editor allow adaptation_clients
adaptation_access html_editor deny all

The client range and service URI are examples. The URI must name an actual ICAP service implementing the response transformation; declaring /modify does not create one. The fragment supplements the proxy's existing listener and access controls.

respmod_precache selects response adaptation at the precache point. adaptation_access selects transactions for that service. The bypass=0 setting means Squid cannot silently skip this service when an applicable transaction encounters a service failure. Choose that failure behavior according to whether the transformation is required.

The adaptation directives are version-specific. In particular, these configuration references list the ICAP service and adaptation-access interfaces for Squid 7 and earlier supported lines, and mark them unavailable in Squid 8. Treat the fragment as a Squid 7 example rather than copying it into an arbitrary release.

Give the service a precise transformation contract

Specify which responses are eligible and which changes are required. An HTML-only transformation should leave images, archives and unrelated media alone. The service also needs to handle the representation it actually receives: compressed bodies, character encodings and the metadata describing the changed body. Inserting text into arbitrary response bytes is not a general HTML transformation.

Consider caching when the replacement is user-specific. A precache transformation and a shared cache are a poor combination if the resulting representation is valid for only one reader. Keep cacheability and transformation policy aligned, and honor applicable no-transform directives.

Finally, an ordinary HTTPS CONNECT tunnel carries encrypted bytes. It does not expose HTML to a response adapter. A deliberately managed TLS inspection arrangement needs its own compatible setup and client trust before decrypted responses can enter this path. The ICAP rule alone does not add that visibility.