caption: Proxy override rules
desc: |-
  Configures rules that select which proxy the browser uses based on the destination URL and specific network conditions.

  This policy takes precedence over the <ph name="PROXY_SETTINGS_POLICY_NAME">ProxySettings</ph> policy, the <ph name="PROXY_SETTINGS_EXTENSION_API">chrome.proxy</ph> extension API, and manual user settings. If no rules in this policy match, the browser falls back to the settings defined in <ph name="PROXY_SETTINGS_POLICY_NAME">ProxySettings</ph>.

  The browser evaluates entries in the <ph name="PROXY_OVERRIDE_RULES_POLICY_NAME">ProxyOverrideRules</ph> list in sequence. A rule is applied only if all of the following criteria are met:

    * Match: At least one URL pattern in <ph name="PROXY_OVERRIDE_RULES_DESTINATION_MATCHERS">DestinationMatchers</ph> is matched.

    * Exclude: No URL patterns in <ph name="PROXY_OVERRIDE_RULES_EXCLUDE_DESTINATION_MATCHERS">ExcludeDestinationMatchers</ph> are matched.

    * Conditions: If <ph name="PROXY_OVERRIDE_RULES_CONDITIONS">Conditions</ph> is specified, all listed conditions must be satisfied. If unset, this requirement is ignored.

  URL patterns for matchers are documented at https://chromium.googlesource.com/chromium/src/+/HEAD/net/docs/proxy.md#proxy-config-url-patterns.

  The <ph name="PROXY_OVERRIDE_RULES_PROXY_LIST">ProxyList</ph> field defines a failover list. The first reachable entry is used; invalid entries are ignored. You can use PAC-style strings or URL-like specifiers:

  PAC-style strings:

    * DIRECT

    * PROXY host:port

    * HTTPS host:port

    * SOCKS4 host:port

    * SOCKS5 host:port

  URL-like specifiers:

    * http://host:port

    * https://host:port

    * socks4://host:port

    * socks5://host:port

  The <ph name="PROXY_OVERRIDE_RULES_DNS_PROBE">DnsProbe</ph> condition checks if a <ph name="PROXY_OVERRIDE_RULES_HOST">Host</ph> resolves to an IP address.

  * Supports hostnames (e.g., example.com) or URI-style strings (e.g., https://example.com:123). Using a secure scheme (https) may trigger an HTTPS record request (see RFC 9460).

  * Set to "<ph name="PROXY_OVERRIDE_RULES_RESOLVED">resolved</ph>" to meet the condition upon successful resolution, or "<ph name="PROXY_OVERRIDE_RULES_NOT_FOUND">not_found</ph>" to meet the condition if resolution fails.

  The application of this policy on managed devices is influenced by the <ph name="ENABLE_PROXY_OVERRIDE_RULES_FOR_ALL_USERS_POLICY_NAME">EnableProxyOverrideRulesForAllUsers</ph> machine-level policy on the platforms where it is supported. By default, it prevents the usage of override rules configured by unaffiliated users.

example_value:
- DestinationMatchers:
  - 'https://some.app.com'
  - 'https://google.com'
  ExcludeDestinationMatchers:
  - 'https://mail.google.com'
  ProxyList:
  - 'HTTPS proxy.app:443'
  - 'DIRECT'
  Conditions:
  - DnsProbe:
      Host: 'corp.ads'
      Result: 'resolved'
features:
  cloud_only: true
  dynamic_refresh: true
  per_profile: true
future_on:
- android
supported_on:
- chrome.*:144-
- chrome_os:144-
owners:
- seblalancette@chromium.org
- domfc@chromium.org
- cbe-eng@google.com
schema:
  type: array
  items:
    type: object
    properties:
      DestinationMatchers:
        type: array
        items:
          type: string
      ExcludeDestinationMatchers:
        type: array
        items:
          type: string
      ProxyList:
        type: array
        items:
          type: string
      Conditions:
        type: array
        items:
          type: object
          properties:
            DnsProbe:
              type: object
              properties:
                Host:
                  type: string
                Result:
                  type: string
                  enum:
                  - resolved
                  - not_found
type: dict
tags:
- system-security
