import requests


def download_pac(candidate_urls, timeout=1, allowed_content_types=None,
                 session=None):
    """
    Try to download a PAC file from one of the given candidate URLs.

    :param list[str] candidate_urls: URLs that are expected to return a PAC file.
        Requests are made in order, one by one.
    :param timeout: Time to wait for host resolution and response for each URL.
        When a timeout or DNS failure occurs, the next candidate URL is tried.
    :param allowed_content_types: If the response has a ``Content-Type`` header,
        then consider the response to be a PAC file only if the header is one of these values.
        If not specified, the allowed types are
        ``application/x-ns-proxy-autoconfig`` and ``application/x-javascript-config``.
    :return: Contents of the PAC file, or `None` if no URL was successful.
    :rtype: str|None
    """
    if not allowed_content_types:
        allowed_content_types = {'application/x-ns-proxy-autoconfig', 'application/x-javascript-config'}

    if not session:
        sess = requests.Session()
    else:
        sess = session
    sess.trust_env = False  # Don't inherit proxy config from environment variables.
    for pac_url in candidate_urls:
        try:
            resp = sess.get(pac_url, timeout=timeout)
            content_type = resp.headers.get('content-type', '').lower()
            if content_type and True not in [allowed_type in content_type for allowed_type in allowed_content_types]:
                continue
            if resp.ok:
                return resp.text
        except (requests.exceptions.ConnectionError, requests.exceptions.Timeout):
            continue