305 Use Proxy
Deprecated. It once told the client to repeat the request through the proxy named in Location, which turned out to be a security problem.
At a glance
- Status code
- 305 Use Proxy
- Class
- 3xx, redirection, further action is needed to complete the request
- Defined in
- RFC 9110, deprecated
- Cacheable by default
- no
- Response body
- Optional.
In detail
A server could redirect a client onto an arbitrary proxy of the server's choosing. Since the proxy then sees every byte of the conversation, that is an obvious interception vector.
Do not use it. Browsers ignore 305 entirely and have done for many years.
Configure proxies through PAC files, system settings or WPAD, none of which let a remote server nominate itself mid-conversation.
Examples
HTTP/1.1 305 Use Proxy
Location: http://proxy.example.net:8080Things that catch people out
- A client that did honour 305 could be redirected onto an attacker-controlled proxy by any server it talked to.
- It is still in the registry, so a naive redirect handler may try to follow it. Reject 305 explicitly.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →302 Found
The resource is temporarily at a different URL. The original URL stays authoritative and should keep being used for future requests.
407 Proxy Authentication Required
A proxy between the client and the server needs credentials. This is 401 raised by the intermediary rather than by the origin.
300 Multiple Choices
The request matched more than one representation and the server is asking the client to pick, rather than choosing for it.
307 Temporary Redirect
Same as 302 but with a guarantee: the client must repeat the request with the original method and body, so a POST stays a POST.
308 Permanent Redirect
A permanent redirect that preserves the request method and body. This is 301 without the historical POST to GET rewrite.
400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL