A PAC file chooses the route before the browser receives the response. It cannot inspect the response's image content type and then retroactively choose another proxy.

A filename ending in .jpg is only a clue. Images can come from extensionless URLs, and a URL that resembles an image can return an error document.

There is another limitation for HTTPS: browsers can remove the path and query before passing the URL to PAC evaluation. A rule looking for /images/ may never receive that text.

Do not rely on old switches that exposed full URLs without checking the current browser's documented behavior. Such switches also change which sensitive URL information becomes visible to the routing script.

If a controlled service publishes assets on a dedicated hostname, a hostname-based policy may express the intended route more clearly. Otherwise, choose a mechanism that actually has the information the decision requires. A PAC script's URL input is not a view of the downloaded page or its DOM.

Artiglyn mynjee