Squid External ACL Caching: Why the Helper Is Not Called Every Time

A helper logging one request and then going quiet can be normal. Squid may evaluate a rule using a cached external-ACL result without sending the helper another query.

Define the reusable decision first. “May this account use the proxy?” needs different inputs from “May this account reach this destination?” The expanded external-ACL format forms the cache key. If the helper decides by username and destination but the key includes only username, a cached approval can apply more broadly than intended. Include every answer-changing input while avoiding details that merely fragment equivalent decisions.

Next choose freshness. Positive ttl and negative_ttl govern matching and non-matching results; grace can initiate refresh before an entry expires. Decide how long a revoked account's cached approval may affect later decisions. None of these settings reauthorizes an established CONNECT tunnel for every byte or inner HTTPS request. If the helper enforces a traffic quota, admitted transfers may continue after the balance changes.

The helper is a persistent protocol participant, not necessarily a new script process for every request. Keep it ready for successive query lines and flush each reply promptly. Put diagnostics on another channel. With concurrency enabled, return the corresponding supplied channel identifier.

Finally, define slow, unavailable and internal-error outcomes, and make the surrounding ACL order produce them. The design is complete when both the specificity and permitted age of a reusable answer match the access requirement.