203 Non-Authoritative Information

Success, but a transforming proxy modified the response from the origin.

203 at a glance

Code: 203
Name: Non-Authoritative Information
Class: 2xx Successful
Status: IANA-registered standard code
Defined in: RFC 9110, Section 15.3.4
Cacheable by default: Yes, heuristically cacheable (RFC 9110 section 15.1): without Cache-Control or Expires, caches may store it and pick a freshness lifetime themselves. Send explicit Cache-Control to stay in control.

What 203 means

203 Non-Authoritative Information means the request succeeded but the payload was changed by a proxy, for example recompressed images or injected content, so it is not exactly what the origin sent. It lets the client know the origin's metadata may not apply. It is heuristically cacheable.

What typically causes a 203

Mobile-network optimising proxies and some corporate proxies that rewrite content.
Rarely, applications misuse it for "success with warnings".

Fix it on the server

Origins never need to send it. If you run a transforming proxy, use it when you alter a 200.
Respect Cache-Control: no-transform from the origin: a proxy should not modify such responses at all.

Fix it as a client or visitor

If you see unexpected 203s, something between you and the server is rewriting traffic; switching to HTTPS usually stops it.

Headers that go with 203

Header	Role
`Cache-Control`	Origins can send `no-transform` to forbid modification.

Example response

HTTP/1.1 203 Non-Authoritative Information
Content-Type: image/webp
Via: 1.1 mobile-optimizer