305 Use Proxy

A 305 response was originally defined to indicate that the requested resource must be accessed through the proxy given by the Location header, rather than directly from the origin server. The idea was to let a server instruct a client to route future requests for a resource through a specific proxy, for example to enforce caching policy or load distribution controlled by the origin rather than by client configuration.

RFC 9110 formally deprecates 305 and instructs that it must not be generated by servers, citing security concerns: the mechanism could be abused to trick a client into routing its traffic, potentially including credentials and other sensitive request data, through an arbitrary third-party proxy specified by whatever server the client happened to talk to first. Because the redirect target was fully server-controlled and largely opaque to the user, it was a poor fit for the trust model of the web.

Most major browsers never fully implemented 305 in the first place, and the ones that did have since removed or ignored it, which compounded the security concern with a practical interoperability problem: server operators could not rely on client support even before the formal deprecation. Today 305 exists in the spec purely as a historical artifact and a reserved code that must not be used in new implementations.

If you see 305 in the wild, it is almost always either a misconfigured legacy system, a deliberately crafted test case, or, occasionally, a status code reused informally for an unrelated purpose by a non-compliant server. There is no forward-looking use case for emitting it.