HTTP 305 Use Proxy – Free, Online, Private

What HTTP 305 means

305 told the client that the request must be sent through the proxy named in Location. Browsers stopped honoring it because a hostile page could use 305 to redirect traffic through an attacker-controlled proxy. RFC 9110 says the status is deprecated and intermediaries should not send it. You should not emit it from a new server.

305 Use Proxy belongs to the 3xx redirection class. Clients that only look at the class will group it with its neighbors. Clients that care about the exact code should use the narrower rule on this page, because the class is only the first digit.

When you see HTTP 305

When you see HTTP 305 Use Proxy, stop on that exact status line. 305 Use Proxy is a deprecated status that told clients to repeat the request through a proxy. The trace that usually produces it: An old origin still emits 305 and a browser ignores it. The 3xx redirection class only tells you the first digit. A neighbor in that class is a different fault, and the fix on this page does not transfer to it.

Do not use 305. If a client must use a proxy, configure the proxy on the client. If a URL moved, use a normal redirect. If you see 305 in a log, treat it as a bug or as a very old server, not as a feature to copy.

How to fix HTTP 305

To fix HTTP 305, change the condition that made the server choose Use Proxy. Ignore 305. Do not switch proxies because a response said so. Show an error if the request cannot succeed without one. Retry the original URL directly. Do not retry through the Location host. If the log line is a different code, leave this page. The mix-up people make with 305 is this one: 407 Proxy Authentication Required is the status a proxy sends when it wants credentials. It is not a request to change your proxy settings, and it is the code people confuse with 305.

• A security scanner flags 305 because of the historical proxy-redirect attack.
• A client library followed Location and sent the user's request to an unexpected proxy.
• Someone chose 305 because the word proxy appeared in a ticket, instead of 407.

An access log that only stores 305 is not enough to tell these apart. Keep the method, the path, and a request id. Do not keep the Authorization header or a request body that might be a token. The status explains the outcome. It is not a place to echo secrets back to the client either.

Example response

HTTP 305 Use ProxyHTTP/1.1 305 Use Proxy
Location: http://proxy.example.com:8080

Location would have been the proxy, not the resource. A client that obeys it rewrites how the request is sent. A client that follows the modern specification does not. Either way, do not generate this response.

What the client should do

Ignore 305. Do not switch proxies because a response said so. Show an error if the request cannot succeed without one.

Do not cache 305. Honoring a stored copy would be worse than honoring it once.

Retry the original URL directly. Do not retry through the Location host.

Codes people confuse with HTTP 305

407 Proxy Authentication Required is the status a proxy sends when it wants credentials. It is not a request to change your proxy settings, and it is the code people confuse with 305.