Allow One Squid Destination Without Proxy Authentication

A monitoring page needs to work without a proxy login. The obvious rule is http_access allow status_site. Placed before authentication, that can also grant the exception to clients you never intended to serve.

For Squid 6 or 7, keep the exception's conditions together. After the existing management, unsafe-port, CONNECT and local-service safeguards, the relevant part can look like this:

acl office_clients src 192.0.2.0/24
acl status_site dstdomain status.example.net
acl signed_in proxy_auth REQUIRED

http_access allow office_clients status_site
http_access allow office_clients signed_in
http_access deny all

The network and hostname are placeholders. Authentication still needs its existing helper configuration. This is the exception portion of an access policy, not a complete proxy configuration.

The first line permits the selected clients to that destination without evaluating the login ACL. The next permits those clients elsewhere only after authentication. Earlier broad allows or later alternative paths can change the result, so read the full ordered policy, including included files.

Do not move the exception above destination-port protections just to avoid a prompt. An authorized site on an unintended port is still a different route. Also decide whether the exact host or its subdomains should qualify rather than adding an unnecessarily broad suffix.

A hostname exception covers the matching destination, not every dependency loaded by its page. Redirects and third-party assets may legitimately encounter the normal login requirement.

For plain HTTP, a proxy can use finer URL information where appropriate. An ordinary HTTPS CONNECT request does not expose the page path, so a “one page only” rule cannot be inferred from a host-wide tunnel exception.