305 Use Proxy
Deprecated. Originally told the client to repeat the request through the proxy named in Location.
Status
HTTP/1.1 305 Use Proxy
Details
- Category: 3xx
- Status: Deprecated. Registered, but the defining specification marks it obsolete.
- Specification: RFC 9110 §15.4.6
- Cacheable: Not cacheable
- Response body: Allowed
- Retry: Do not retry
305 was meant to let an origin server direct a client to a specific proxy. It is deprecated because of the obvious security problem: any server able to answer a request could redirect a client's traffic through a host of its choosing, and clients had no way to judge whether that was safe.
Modern clients ignore it, and RFC 9110 states that a server must not generate it. Proxy selection today is a client-side configuration matter, handled by explicit settings, environment variables, or a PAC file.
Note: RFC 9110 states that a server must not generate 305 and that clients should ignore it. Proxy selection belongs in client configuration, not in a response from a remote server.
Common causes
- Very old server software implementing the original HTTP/1.1 text.
- A misconfigured appliance attempting to force clients onto an internal gateway.
Usage notes
For clients
- Ignore it. Configure proxies explicitly in the client rather than letting a remote server choose one.
For servers
- Do not send it. If a proxy is mandatory on a network, enforce that at the network layer or with a PAC file, and return 407 when authentication through the proxy is required.
Examples
A legacy server pointing at a proxy
HTTP request
GET /internal/report HTTP/1.1 Host: legacy.example.com
HTTP response
HTTP/1.1 305 Use Proxy Location: http://proxy.internal.example.com:8080
Notes for proxy users
Nothing in normal proxy operation should ever produce a 305. If you see one, an intermediary is trying to reroute your traffic, which is worth investigating before following it.