Subject: 305 Use Proxy deprecated?

From: Adrien de Croy <[email-masked]>
Date: Fri, 15 Jun 2007 17:16:00 +1200

Hi All

can't find any browser that supports this.

* IE 6 silently fails (shows blank page, does not attempt connection to 
proxy).
* FF 2 silently fails (shows blank page, does not attempt connection to 
proxy).
* Opera displays message "The server tried to redirect Opera to the 
alternative proxy "http://xxxxxxxx". For security reasons this is no 
longer supported."

So looks like the main browsers (haven't tried Safari) have de facto 
deprecated it.

Is it an optional code to handle?  RFC2616 is extremely sparse in its 
description of the status code.

Adrien

---

From: Eric Lawrence <[email-masked]>
Date: Fri, 15 Jun 2007 10:24:27 -0700

As you noted, Internet Explorer (and WinINET/WinHTTP) has never supported this status code.

As implied in the RFC, there are potential security concerns for supporting this status code, and it's not clear that its practical usefulness outweighs its complexity.

Eric Lawrence
Program Manager
Internet Explorer

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Adrien de Croy
Sent: Thursday, June 14, 2007 10:16 PM
To: HTTP Working Group
Subject: 305 Use Proxy deprecated?

Hi All

Adrien

---

From: Henrik Nordstrom <[email-masked]>
Date: Fri, 15 Jun 2007 22:51:04 +0200

> can't find any browser that supports this.

I fail to find use cases where 305 makes much sense, and several
security concerns.

proxies is normally in the users administrative realm, while 305 is only
issued by origin servers (MUST NOT be issued by proxies..). This has
notable implications on authentication, making 305 a very odd case.

To me it simply doesn't make any practical sense. The normal redirects
suits those use cases where a server wants the request to be sent via
another server much better I think.

> So looks like the main browsers (haven't tried Safari) have de facto 

Yes. Or rather all browsers except Opera choose to ignore 305
completely.

Also I don't think there is many proxies implementing 305.

For 305 to work out the way it is designed it must be handled as a
hop-by-op operation, redirecting the last hop via the indicated proxy.
It should not go up to the user-agent if the user-agent is already using
a proxy.

Regards
Henrik

---

From: Adrien de Croy <[email-masked]>
Date: Sat, 16 Jun 2007 22:19:25 +1200

It's certainly interesting.

Reading through the posts about it from 1997, it originally had quite a 
different perceived use I think, since it was foreseen that it would be 
used by proxies more than by origin servers I think... at some stage use 
by proxies was banned.

I can see a couple of useful scenarios where it would be useful for a 
server to tell a UA to use a proxy, but most of these use cases would be 
where it was a proxy telling a client.

for instance a distributed cache, where one proxy in a cluster which 
shares a common cache index gets a request which is hosted on another 
proxy in the cluster - to be able to redirect the UA to the proxy that 
holds the file would be one use case (rather than the proxy simply 
diverting through to the other cluster member).

The other case could be load balancing.

But anyway, not a biggie.  I think given the extreme lack of wording on 
the code in the spec, perhaps some words could be added to discourage 
anyone from wasting their time implementing it in a server.

Regards

Adrien