Based on a quick perusal of their web site, WebSense doesn't look like it normally locks you out based on which proxy server you use. It simply looks at *who* you are, what web site you're requesting, and what time it is, and allows or denies based on that.

It does, however, appear that it can be configured to use NTLM authentication to see who you are, and curl doesn't support this. Have you tried proxying a request through your "front-line" proxy server? Use the "-i" flag for curl to see the headers coming back. I wonder if one of them doesn't look like:

 WWW-Authenticate: NTLM
or
  Proxy-Authenticate: NTLM

If so, you'll no longer need to write an APC parser. Instead you'll be writing an NTLM authentication engine ;-)

As for why someone's APC comes from a different server other than the proxy... The APC file needs to be served up via a standard WWW server (though not necessarily on port 80). The proxy server is more than just a WWW server. The reason you've got 'em on two different servers has nothing to do with looping; probably just a proxy server admin that didn't want to have anything more running on his/her proxy server than was necessary. At my company the APC file is served off of one specific proxy server (although we have a dozen or so).

--Kevin

_______________________________________________________________

Don't miss the 2002 Sprint PCS Application Developer's Conference
August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm
Received on 2002-05-21