RFC 7725

An HTTP Status Code to Report Legal Obstacles

📅 published February 2016, from ietf

📜 An HTTP Status Code to Report Legal Obstacles 🎀

Okay bestie, this one is a Standards Track doc from February 2016 (ISSN 2070-1721) 💅 It's by Tim Bray of Textuality, and it doesn't obsolete or update anything, since its header doesn't list any. It's basically the IETF saying "hey, when the law is why you can't get something, the server should say so." Iconic ✨

Abstract

This doc defines a Hypertext Transfer Protocol (HTTP) status code for when access to a resource gets denied because of legal demands 🧚

Status of This Memo

This is an Internet Standards Track document 🌸

It's a product of the Internet Engineering Task Force (IETF) and represents the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 5741.

For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc7725.

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the publication date. Please actually read these, because they spell out your rights and restrictions for this document 🙈 Code Components pulled out of this document must include the Simplified BSD License text described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes.

1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
2.  Requirements  . . . . . . . . . . . . . . . . . . . . . . . .   2
3.  451 Unavailable For Legal Reasons . . . . . . . . . . . . . .   2
4.  Identifying Blocking Entities . . . . . . . . . . . . . . . .   3
5.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   4
7.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   4
Acknowledgements  . . . . . . . . . . . . . . . . . . . . . . . .   5
Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   5

1. Introduction 🦋

Okay so this doc defines an HTTP status code for when a server operator has gotten a legal demand to block access to a resource, or to a set of resources that includes the one you asked for 😭

The code is there for transparency, for when law or public policy is messing with how a server runs. That transparency helps the operators and the end users, which is honestly so fair 💖

[RFC4924] talks about all the forces working against transparent operation of the Internet, and legal stuff that restricts access to content is clearly one of them. As that doc points out, and as Section 4 of [RFC4084] says, those restrictions should be made explicit 👑

2. Requirements 💜

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. Those are the official rules-words, so read them carefully 🫶

3. 451 Unavailable For Legal Reasons 🌈

This status code means the server is denying access to the resource because of a legal demand. Simple, but important ✨

The server doing the blocking might not be the origin server. Honestly this kind of demand mostly hits ISPs and search engines the hardest 🍓

Responses using this status code SHOULD include an explanation in the response body. The explanation covers the details of the legal demand: who made it, which law or regulation it comes from, and which classes of person and resource it applies to. Here's an example bestie will love 🏛️

HTTP/1.1 451 Unavailable For Legal Reasons
Link: <https://spqr.example.org/legislatione>; rel="blocked-by"
Content-Type: text/html

<html>
 <head><title>Unavailable For Legal Reasons</title></head>
 <body>
  <h1>Unavailable For Legal Reasons</h1>
  <p>This request may not be serviced in the Roman Province
  of Judea due to the Lex Julia Majestatis, which disallows
  access to resources hosted on servers deemed to be
  operated by the People's Front of Judea.</p>
 </body>
</html>

The 451 code doesn't tell you whether the requested resource exists or not 🙈 So even if the legal demands got lifted, a request for that resource still might not succeed. Plot twist!

Also, in lots of cases, clients can still reach the blocked resource with technical workarounds like a VPN or the Tor network 🧚

A 451 response is cacheable by default, meaning unless the method definition or explicit cache controls say otherwise. See [RFC7234] for the details 💅

4. Identifying Blocking Entities 🔍

Like we said above, when an attempt to reach a resource fails with status 451, the entity doing the blocking might or might not be the origin server. There's a whole bunch of entities along the resource-access path that could choose to deny access, like ISPs, cache providers, and DNS servers 👀

When legal blockages happen, it's really useful to be able to figure out which entities are actually doing the blocking 💖

When an entity blocks access to a resource and returns status 451, it SHOULD include a Link HTTP header field [RFC5988] whose value is a URI reference [RFC3986] that identifies itself. When used this way, the Link header field MUST have a rel parameter whose value is blocked-by. 🎀

The point here is that the header identifies the entity actually implementing the blockage, not some other entity that's mandating it. The human-readable response body is where you talk about the admin and policy stuff, as we covered above 📜

5. Security Considerations 🚨

Clients cannot rely on the 451 status code. Certain legal authorities might want transparency to go out the window. They could not only demand that access to certain resources be restricted, but also avoid disclosing that the demand was ever made. Yikes 💀

6. IANA Considerations 🌸

The HTTP Status Codes Registry got a new entry:

Code: 451
Description: Unavailable For Legal Reasons
Specification: RFC 7725

The Link Relation Type Registry got a new entry too:

Relation Name: blocked-by
Description: Identifies the entity that blocks access to a resource following receipt of a legal demand.
Reference: RFC 7725

7. References 📚

7.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
           Resource Identifier (URI): Generic Syntax", STD 66,
           RFC 3986, DOI 10.17487/RFC3986, January 2005,
           <http://www.rfc-editor.org/info/rfc3986>.

[RFC5988]  Nottingham, M., "Web Linking", RFC 5988,
           DOI 10.17487/RFC5988, October 2010,
           <http://www.rfc-editor.org/info/rfc5988>.

[RFC7234]  Fielding, R., Ed., Nottingham, M., Ed., and J. Reschke,
           Ed., "Hypertext Transfer Protocol (HTTP/1.1): Caching",
           RFC 7234, DOI 10.17487/RFC7234, June 2014,
           <http://www.rfc-editor.org/info/rfc7234>.

7.2. Informative References

[RFC4084]  Klensin, J., "Terminology for Describing Internet
           Connectivity", BCP 104, RFC 4084, DOI 10.17487/RFC4084,
           May 2005, <http://www.rfc-editor.org/info/rfc4084>.

[RFC4924]  Aboba, B., Ed. and E. Davies, "Reflections on Internet
           Transparency", RFC 4924, DOI 10.17487/RFC4924, July 2007,
           <http://www.rfc-editor.org/info/rfc4924>.

Acknowledgements 🫶

Huge thanks to Terence Eden, who noticed that the existing status code 403 wasn't really a good fit for this situation, and suggested making a brand new status code. Iconic move 👑

Thanks also to Ray Bradbury 📖

Author's Address 🦋

Tim Bray Textuality

Email: tbray@textuality.com URI: http://www.tbray.org/ongoing/

📦 where this page comes from

ietf: rfc7725 2016-02
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms