203 Non-Authoritative Information

Meaning & Description

The HTTP `203 Non-Authoritative Information` success status response code indicates that the request was successful, but the enclosed payload has been modified by a transforming proxy from that of the origin server's 200 OK response. This code allows a proxy to notify the client that the data it is receiving is not exactly what the origin server sent. It is rarely used in modern API development.

Common Causes

A proxy server (like Squid or a corporate firewall) is transforming the content (e.g., stripping metadata, converting image formats, or injecting scripts).

How to fix a 203 error

If the transformation is unexpected, check if you are behind a corporate proxy or VPN.
Inspect the headers to see if a CDN or proxy has added identifiers (like Via or X-Cache).
Compare the response received directly from the origin server bypassing the proxy.

Browser & SEO Behaviour

Browser Behavior

Browsers treat this identically to a 200 OK response and render the content normally.

SEO Impact

Neutral. Search engines will treat it as a 200 OK, though altering canonical content via proxy can cause SEO inconsistencies if not careful.

CDN Behavior

A CDN may generate this code if it applies aggressive on-the-fly transformations (like image compression).

Code Examples

Raw HTTP

HTTP/1.1 203 Non-Authoritative Information
Date: Mon, 23 May 2026 22:38:34 GMT
Content-Type: text/html
Via: 1.1 proxy.example.com

<html><!-- Modified by Proxy -->...</html>

Node.js (Express)

app.get('/proxy-content', async (req, res) => {
  const response = await fetch('https://origin.example.com');
  let data = await response.text();
  // Proxy modifies the data
  data = data.replace('http:', 'https:');
  
  res.status(203).send(data);
});

Python (FastAPI)

from fastapi import FastAPI, Response, status

app = FastAPI()

@app.get("/proxy", status_code=status.HTTP_203_NON_AUTHORITATIVE_INFORMATION)
def proxy_transform(response: Response):
    # Simulate a proxy transforming data
    return {"data": "Transformed content"}

Go (net/http)

func proxyHandler(w http.ResponseWriter, r *http.Request) {
    w.WriteHeader(http.StatusNonAuthoritativeInfo)
    w.Write([]byte("Transformed payload"))
}

C# (ASP.NET Core)

[HttpGet]
public IActionResult GetTransformedData()
{
    // Assuming origin returned 200, but we modified it
    return StatusCode(203, new { message = "Transformed data" });
}

cURL

curl -I https://proxy.example.com/api/data

Raw HTTP Response Example

HTTP Response

HTTP/1.1 203 Non-Authoritative Information
Date: Mon, 23 May 2026 22:38:34 GMT
Content-Type: application/json
Via: 1.1 proxy-cache

{"modified": true}

Real-world Examples

Squid Cache: May return 203 when configured to transform or filter content before returning it to local network clients.

Cloud-based Web Filters: Corporate web filters might return 203 when they alter an HTML page to remove inappropriate content or block ads.

Frequently Asked Questions

Is 203 Non-Authoritative Information an error?

No, it is a success code (2xx category). It simply acts as a warning or informational flag that the data has been altered since it left the original server.

Do I need to handle 203 differently than 200 in my front-end code?

Almost never. Fetch and Axios will resolve the promise successfully. Unless your application requires absolute cryptographic integrity of the original payload (which should be handled via HTTPS and signatures anyway), you can treat it as a 200.

Why do I rarely see a 203 status code?

Because of HTTPS. End-to-end encryption prevents intermediary proxies from inspecting or modifying the payload. Since they cannot modify the payload, they cannot return a 203. It is mostly seen in internal networks with SSL termination.

Did You Know?

The 203 status was much more relevant in the early days of the web when unencrypted HTTP traffic was heavily compressed, transcoded, or modified by ISP proxies.

With the ubiquity of TLS (HTTPS), true man-in-the-middle proxies that can issue a 203 are practically extinct on the public internet.

Developer Tips

If you are building an origin application server (like a standard REST API), never return a 203. Always return 200 OK. Only return 203 if you are explicitly building proxy middleware.
Ensure your proxy includes a `Via` header when returning a 203 to help developers trace the request path.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 203.

What is the purpose of the 203 Non-Authoritative Information status?

It is returned by an intermediary proxy to indicate that while the request was successful, the proxy has modified the payload (like compressing an image or minifying HTML) from what the origin server originally sent.

Why has the 203 status code become extremely rare on the modern internet?

The widespread adoption of HTTPS encrypts traffic end-to-end. Intermediary proxies can no longer inspect or modify the payload in transit, which eliminates the scenario where a proxy would need to return a 203.

Common Interview Mistakes

Confusing "Non-Authoritative" with DNS responses (like a non-authoritative DNS server). In HTTP, it specifically refers to proxy payload transformations.
Suggesting that an API should return 203 when returning data from a cache. (A cache hit that is unmodified still returns 200 OK, often with an Age header, not 203).