Squid was designed with the capability to call external programs for authentication , it also allows you to call a redirector (most based on squidguard , some on dansguardian.)
If a redirector is specified squid applies all it's ACL's and if the request passes it then sends it to the redirector.
the redirectors are mostly used to apply an additional set of ACL's normally to block access to undesireable sites from a corporate or educational viewpoint(porn, warez, phishing sites , dating , racism, violence ,etc)
Normally used to check against a list of blacklists and if the request matches a deny rule the browser is redirected to a site that denies the access (in our case a site giving the username , source hostname , and reason site was blocked, as well as the company internet usage policy)
A CGI script normally does this quite well.
If it matches an allow rule the request is passed.
At the end there is a default allow or deny rule , this applies if no other rule is matched.
It works like squid , IE the first matching policy applies.
There are free blacklists that you can download (notably squidGuard has one of the better ones) however they are not always updated timeously so due to the dynamic nature of the internet they tend to go out of date rather quickly , this can lead to unneccesary virus exposure on your network , and sites being allowed erroneously , or blocked when they are harmless.
As in our situation this was not acceptable , we decided to use the ufdbGuard redirector (software is free , and extremely fast)
And buy the blacklist subscription from them , and I must say they are extremely good , the lists are updated daily , and 99.9% of the sites are correctly categorized.
However the free lists are definitely better than no lists , so if your budget does not allow the paid option the squidGuard list is very good , and you can still use faster ufdbGuard redirector engine as it is free.
If you are working for a educational institution then DansGuardian is free , and it incorporates some very nice additional functionality (is free for libraries , schools , personal use , but not free for corporate use , licence fees are quite reasonable though)