HTTP 306 (Unused)

What 306 (Unused) means

The registry entry is literally the word “(Unused)” in parentheses, and that is the whole definition. The number is burned: it cannot be handed to a future code because too much old software might hold assumptions about it, so it sits in the registry marking the gap between 305 and 307.

The practical consequence is that 306 gives a client nothing beyond the generic 3xx class rule. A conforming client treats it as an unrecognised 3xx: no redirect is followed, no caching heuristic applies, and the response is handled as a plain, unsuccessful reply.

What the spec says

RFC 9110 §15.4.7 says the code was defined in a previous version of the specification, is no longer used, and is reserved. That is the entire section. The IANA HTTP Status Code Registry lists it as (Unused) with RFC 9110 as its reference. What matters operationally is the fallback rule in §15: a client that does not recognise a status code must understand it by its class, so an unknown 3xx is treated as equivalent to x00 — here 300 — and is not cacheable unless explicitly marked.

Why you will never see it

No current specification defines 306, no server framework offers a helper for it, and no browser has a code path for it. If one turns up in your logs it is one of three things: a status-code test harness, a synthetic endpoint, or a bug where an integer holding a status was never assigned a value. Chase the third — a 306 in production usually means the code path returning it never intended to return anything. Vendor documentation that gives 306 a name is copying a draft withdrawn before HTTP/1.1 shipped.

How to debug it

Confirm the code is real rather than a logging artifact, then find the process that produced it:

curl -sSI https://httpbin.org/status/306 | head -1

Compare the status your edge logged with the status the origin logged for the same request ID. If the origin never emitted 306, something between them synthesised it, and the reverse proxy’s error-mapping configuration is the place to look.

If your own application produced it, grep for the literal 306 in status assignments and constant tables. It is rare enough that a plain text search usually finds the responsible line in one pass. Replace it with a code that means something: 307 or 308 for a redirect, or a 4xx if the request was actually unacceptable.

Working examples

curl

# Nothing to follow: -L has no effect because 306 is not a redirect.
curl -sSI https://httpbin.org/status/306 | head -1

# Confirm curl treats it as an ordinary response and exits 0:
curl -sS -o /dev/null -w '%{http_code}\n' -L https://httpbin.org/status/306

Python (requests)

import requests

resp = requests.get("https://httpbin.org/status/306", timeout=10)

# 306 is not in requests.models.REDIRECT_STATI, so nothing is followed.
print(resp.status_code, resp.is_redirect, resp.history)  # 306 False []

# Treat unknown 3xx by class, as the spec requires.
if 300 <= resp.status_code < 400 and not resp.headers.get("Location"):
    print("unknown 3xx with no target; nothing to do")

Node (fetch)

// fetch() only follows 301, 302, 303, 307 and 308. A 306 lands as-is.
const resp = await fetch("https://httpbin.org/status/306");

console.log(resp.status, resp.redirected, resp.headers.get("location"));
// 306 false null

if (resp.status >= 300 && resp.status < 400 && !resp.headers.get("location")) {
  console.warn("unrecognised 3xx: handling as 300 per RFC 9110 class fallback");
}

Reference and tooling

The authoritative list of assigned status codes is theIANA HTTP Status Code Registry. For a searchable copy with the semantics summarised, use theHTTP status code reference on this site. To see exactly what a server is sending, theheader inspector shows the raw status line and response headers, and thecurl builder assembles the request flags for you.

306 (Unused)

Common causes at a glance