Lame corporate proxies

Like a lot of weblogs out there, we use filtering technology to detect and block spambots, dodgy referrers and automated link spam specialists.

While our anti-spam software effectively blocks around 99% of all comment spam, we occasionally get some false positives and inadvertently block some humans as well. As of last week, this is what our stats reveal about some of the reasons why both spambots and human visitors are denied access to our website:

^A Often caused by a misconfigured web proxy or corporate firewall.
^B Often caused by a misconfigured personal firewall or browser privacy software.

As you can see, around two out of three of all blocked attempts are due to misconfigured web proxies, corporate and personal firewalls which often mangle the HTTP headers on behalf of the users browser.

While a percentage of these problems are caused by crappy personal firewall default settings, the majority eminate from visitors sitting behind lame corporate proxy servers. The RFC 2616 specification defines a corporate “transparent proxy” as:

“A proxy that does not modify the request or response beyond what is required for proxy authentication and identification.”

In other words, a properly configured proxy should not obstruct browser authentication at all. So why do so many of them manage to do exactly that?

Posted in Security, Web by Ivan