HTTP status code · Redirection (3xx)
305 Use Proxy
305 Use Proxy once told the client to repeat its request through the proxy named in the Location header. It is deprecated and browsers ignore it; if you see one today, a very old server, appliance or custom middleware sent it.
| Class | 3xx, Redirection |
|---|---|
| Defined in | RFC 9110 §15.4.6 |
| Cacheable by default | Only with explicit Cache-Control or Expires |
| Safe to retry | No; modern clients do not act on it |
| Relevant headers |
|
| Status | Deprecated: Deprecated since RFC 7231 (2014) over the security risk of configuring a proxy from inside a response. |
What 305 means
RFC 2616 defined 305 so an origin server could say "reach me through this proxy", and only origin servers were allowed to send it. RFC 7231 deprecated it in 2014 because letting a response reconfigure the client’s proxy is a security hole: a malicious or compromised server could route the victim’s later requests through an attacker. RFC 9110, section 15.4.6, now records only that it is deprecated.
Its neighbor is odder still. 306 was Switch Proxy in an early HTTP/1.1 draft, was dropped before publication, and RFC 9110 keeps the number reserved as unused. Neither code should be sent by anything written today.
Common causes
If you run the server
- A legacy application, embedded device or old proxy appliance that still emits 305.
- Custom middleware that picked 305 because the name sounded right for "go through the gateway", usually meant as a routing hint.
How to fix it
If you run the server
- Configure proxies on the client side instead: system proxy settings, a PAC file, or HTTP_PROXY and HTTPS_PROXY environment variables.
- If the 305 was really a routing hint, replace it with a 307 or 308 to the right host.
How to send 305
Do not send 305. Browsers ignore it, and there is no framework helper for it on purpose; use client-side proxy configuration or a normal redirect.
Commonly confused with
- 305 vs 407
- 407 Proxy Authentication Required is the live proxy-related code: a proxy you are already using wants credentials.
- 305 vs 307
- 307 sends the same request to a different URL on a different host, which covers most of what people tried to do with 305.
Frequently asked questions
- Why was 305 Use Proxy deprecated?
- Because any server could use it to tell a client to send later traffic through a proxy of its choosing. RFC 7231 deprecated it in 2014 over those security concerns, and browsers stopped honoring it.
- What is HTTP status code 306?
- Nothing today. It was Switch Proxy in a draft of HTTP/1.1, was removed before the RFC was published, and RFC 9110 reserves 306 as unused.
- What should I use instead of 305?
- Configure proxies on the client (system settings, PAC files, HTTP_PROXY variables). If you only need to send the client to another host, use 307 for a temporary move or 308 for a permanent one.
Last reviewed by Arielton Oberek.