Use Proxy
ActiveHTTP 305 Use Proxy was defined in HTTP/1.1 to indicate that the requested resource must be accessed through the proxy server specified in the Location header. It has been deprecated and must not be generated by origin servers. The security implications – a server directing clients to an attacker-controlled proxy – made it too dangerous to use in practice.
Description
305 was intended to allow servers to tell clients to use a specific proxy for subsequent requests. The Location header would contain the proxy URL. However, this creates a serious security vulnerability: a compromised or malicious server could direct clients to route all their traffic through an attacker-controlled proxy, enabling man-in-the-middle attacks. RFC 7231 deprecated 305 and stated that it must not be generated by origin servers. Many user agents never implemented it correctly.
Examples
HTTP/1.1 305 Use Proxy
Location: http://proxy.example.com:8080
# RFC 9110 prohibits origin servers from generating thisEdge Cases
- •RFC 9110 explicitly states: 'origin server MUST NOT generate a 305.'
- •Many clients, including modern browsers, ignore or mishandle 305.
- •305 was deprecated in RFC 2616 (1999) and the prohibition was reinforced in all subsequent HTTP specifications.
When You'll See This
- →Legacy proxy auto-configuration systems (historical)
- →Should not appear in any modern deployment
Implementation References
| Language | Constant |
|---|---|
| All languages | 305 – do not implement or generate |
History
Defined in RFC 2068 (HTTP/1.1, 1997). Deprecated in RFC 2616 (1999) due to security concerns. RFC 7231 (2014) and RFC 9110 (2022) both prohibit its use by origin servers.
Related Status Codes
Related Headers
FAQ
Why was 305 deprecated?
A server returning 305 could instruct the client's browser to route all requests through an attacker-controlled proxy, enabling man-in-the-middle attacks. The risk was severe enough that RFC 9110 explicitly prohibits origin servers from generating it.