An ICAP Scanner Needs a Proxy in Front of It
Place an ICAP adaptation service in its correct role instead of entering its port as a browser proxy.
browser → forward proxy → website
↕
ICAP serviceConfigure the browser to use the forward proxy, not the scanner's ICAP port. The proxy is the ICAP client; the scanner is the ICAP server. A listener on port 1344 can be healthy without understanding browser-style HTTP proxy requests or CONNECT.
The ICAP side path receives selected HTTP messages for inspection or adaptation. It is not necessarily another Internet exit in a serial proxy chain.
Choose the stage according to what must be inspected. REQMOD handles submitted requests; RESPMOD handles submitted responses. A response scanner does not by itself inspect uploads. The chosen proxy product needs ICAP client support for the service and stage you require.
In Squid versions with ICAP support, service definitions and adaptation-access rules are separate. Declaring the scanner is not enough to pass every transaction to it. For a Squid 7 response service, configure ICAP service selection and adaptation access together. Define whether a service error blocks a request or allows the configured bypass as part of the filtering requirement.
Ordinary CONNECT also leaves HTTPS application content encrypted. Passing the tunnel through a proxy does not supply an HTTP response body to scan. Any deliberate TLS decryption arrangement needs its own compatible setup and client trust.