Why was 305 Use Proxy deprecated?
It let any server tell clients to send traffic through a proxy of its choosing, which attackers could abuse to intercept requests. Browsers stopped honoring it for that reason.
HTTP 305 USE PROXY
Deprecated. Clients ignore it for security reasons. 305 belongs to the 3xx redirection class and is defined in RFC 9110.
Loading the workbench.
About HTTP 305
What Does HTTP 305 Use Proxy Mean?
Deprecated. Clients ignore it for security reasons. The code is registered with IANA and defined in RFC 9110.
Redirection: the client must take another step to finish the request. Every code from 300 to 399 shares that general meaning, so a client that does not recognise 305 must treat it like 300.
When Do You See a 305 Response?
305 Use Proxy once told the client to repeat the request through the proxy named in the Location header. It was deprecated because letting any server redirect a client into an arbitrary proxy is a serious security hole: an attacker could route traffic through a machine they control. Modern browsers and HTTP libraries refuse to act on it, so you will only see it from very old or misconfigured software.
How Do You Handle a 305?
Do not send 305 from any server. Clients should treat it like a generic 3xx without following it automatically, or as an error. If traffic genuinely must go through a proxy, configure that on the client side, through system or environment proxy settings, a PAC file, or the library's proxy option, rather than asking a server to instruct clients.
What Does a 305 Response Look Like?
HTTP/1.1 305 Use Proxy
Location: http://proxy.example.com:8080/305 is not cacheable by default: a browser or CDN stores it only when Cache-Control or Expires explicitly allows it.
To inspect a real one without sending it anywhere:
- Copy the response headers from your browser Network tab, or from
curl -i. - Paste them into the Header decoder to see every header explained.
- Check caching in the Cache lane and the Location target in the decoder.
Which Status Codes Are Related to 305?
- 306 Unused (Formerly Switch Proxy): Reserved. Was "Switch Proxy" in a draft and is no longer used.
- 407 Proxy Authentication Required: Like 401, but the proxy needs credentials.
- 302 Found: A temporary redirect. Clients may change POST to GET; use 307 to forbid that.
Browse every code on the HTTP status codes page.
What Other Lanes Are in the Reference Section?
- HTTP status codes: Every IANA-registered status code, with a page per code.
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
What should I do if an old server returns 305?
Do not follow it automatically. If a proxy is genuinely needed, configure it explicitly in the client or operating system settings.
Is HTTP 305 an error?
No. 305 is a redirection response, not an error.
Is a 305 response cacheable by default?
No. Caches store a 305 only when Cache-Control or Expires explicitly allows it.
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.