305 Use Proxy
The requested resource must be accessed through the proxy given by the Location field.
Usually happens because:
- ☑ Legacy proxy routing protocols requiring
- ☑ Historical network boundary access restrictions.
🔍 Quick Checklist:
Meaning
The HTTP 305 Use Proxy redirection status code is deprecated and no longer used due to security concerns. It instructed browser clients that they must access the requested resource through the proxy specified in the Location header.
Root Causes
- Legacy proxy routing protocols requiring client configuration switches.
- Historical network boundary access restrictions.
| Cause | Frequency |
|---|---|
| Legacy proxy routing protocols requiring | ⭐⭐⭐⭐⭐ |
| Historical network boundary access restrictions. | ⭐⭐⭐⭐ |
Common Mistakes
- Using 305 Use Proxy in modern APIs (causes security blocks in modern browser engines).
- Omitting proxy parameters in the Location header.
How to Fix
Framework-Specific Examples
Express returning legacy status 305.
app.get('/legacy-path', (req, res) => {
res.status(305).set('Location', 'http://proxy.com:8080').end();
});Server Configuration Examples
Standard proxy forward configurations.
proxy_pass http://internal_proxy;Prevention
- Never generate 305 responses in modern web services.
- Migrate client traffic to VPN/WAF architectures instead.
Frequently Asked Questions (FAQ)
Q: Why is HTTP 305 deprecated?
Due to major security vulnerabilities. Allowing servers to dynamically configure the client's proxy settings exposes users to Man-In-The-Middle (MITM) attacks and credential hijacking.
Q: How do modern browsers handle 305 Use Proxy?
For security reasons, modern browsers (Chrome, Firefox, Safari) refuse to follow 305 redirects and treat them as failed connection attempts.
Q: What replaced 305 Use Proxy?
Transparent reverse proxies (like Nginx, HAProxy, CDNs) which handle proxy routing on the server-side, hiding proxy logistics from the client.
Q: Was 305 Use Proxy cacheable?
No. The 305 response was never cacheable to prevent browsers from permanently routing all traffic to arbitrary proxies.