pfSense » pfSense Packages

"Custom Options (After Auth)" configuration field in Services → Squid Proxy Server → General does not work when Authentication Method is set to "None".
Steps to Reproduce:

Navigate to Services → Squid Proxy Server → Authentication
Set Authentication Method to "None"
Navigate to Services → Squid Proxy Server → General
Add configuration directives to the "Custom Options (After Auth)" text field
Save and apply changes
Verify configuration with: grep -i "custom options after auth" /usr/local/etc/squid/squid.conf

Expected Behavior:
The custom options should be written to squid.conf regardless of authentication status, as the field is available and accepts input in the GUI.
Actual Behavior:
The custom options are saved to /cf/conf/config.xml (verified in custom_options2_squid3 field), but are never written to the generated /usr/local/etc/squid/squid.conf file.
Root Cause:
In /usr/local/pkg/squid.inc around line 2108, the code that writes "Custom Options After Auth" is located inside the authentication configuration block:

phpif ($auth_method != 'none') {
// Authentication setup code
// ...
$conf .= "# Custom options after auth\n" . sq_text_area_decode($settingsconfig['custom_options2_squid3']) . "\n\n";
}

This means the field only functions when authentication is enabled.
Additional Context:
In transparent proxy mode, authentication cannot be enabled (generates error: "Authentication cannot be enabled while transparent proxy mode is enabled"). This means users in transparent mode have no way to use the "Custom Options (After Auth)" field.
Suggested Resolution:
Option A (Preferred): Move the "Custom Options After Auth" processing outside the authentication conditional block so it works regardless of authentication status.
Option B: Add a UI warning/tooltip to the "Custom Options (After Auth)" field stating it only functions when authentication is enabled.
Option C: Hide the "Custom Options (After Auth)" field entirely when authentication is disabled.
Workaround:
Use "Custom Options (Before Auth)" field instead, which works in all configurations.