HTTP/2

HTTP/2
Name	HTTP/2
Developer	IETF
Initial release	2015
Type	Application layer protocol
Status	Standardized

HTTP/2

HTTP/2 is a major revision of the Hypertext Transfer Protocol series that modernized web communication by introducing multiplexing, header compression, and binary framing. It retained the semantic model of request methods and status codes from earlier editions while reworking the wire format to improve efficiency for contemporary World Wide Web traffic dominated by rich media from providers such as Netflix, YouTube, Facebook, Amazon (company), and Google LLC. The specification was produced in the context of standards work involving organizations like the Internet Engineering Task Force, the World Wide Web Consortium, and implementers from companies including Mozilla Foundation, Microsoft, Apple Inc., and Cloudflare.

Overview

HTTP/2 redefines how clients and servers exchange messages on the Internet. Rather than the text-based, sequential frames of earlier editions, it uses a binary framing layer that allows concurrent streams, prioritized delivery, and efficient flow control between endpoints such as browsers like Mozilla Firefox, Google Chrome, Microsoft Edge, and Apple Safari. The design aimed to reduce latency and head-of-line blocking observed in deployments involving content from platforms like Twitter, LinkedIn, Pinterest, and Spotify while preserving compatibility with established methods formalized in documents from the IETF HTTP Working Group.

History and Development

Work leading to HTTP/2 followed experiments and proposals from projects such as SPDY developed by Google LLC engineers and performance analyses by research groups at institutions like MIT and Stanford University. The IETF formed an effort where participants from vendors including Akamai Technologies, Fastly, AOL, and Yahoo! contributed drafts that converged into a standard published in 2015. The standardization process drew on prior work in protocols like TLS and on compression techniques researched at organizations including GNU Project and University of California, Berkeley. The evolution reflected lessons learned from large-scale deployments by companies like Dropbox, Box (company), Facebook, and various content delivery networks including Akamai and Cloudflare.

Technical Features

HTTP/2 introduces a binary framing layer inspired by designs used in systems from Google LLC and Akamai Technologies. Core features include multiplexed streams, stream prioritization, header compression using HPACK (with contributions from engineers at Mozilla Foundation and Google), stream reset and push capabilities used experimentally by services like Google Search and Facebook for speculative delivery, and per-stream flow control akin to mechanisms in TCP implementations by vendors such as Cisco Systems and Juniper Networks. The protocol separates logical messages into frames handled by state machines implemented in projects like nginx, Apache HTTP Server, and Lighttpd. It interoperates with security layers like Transport Layer Security and was influenced by research from academic groups including Carnegie Mellon University and ETH Zurich.

Deployment and Adoption

HTTP/2 saw early adoption in major browsers—Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge—and in server software including nginx, Apache HTTP Server, Microsoft IIS, and Caddy (web server). CDNs and cloud providers such as Akamai, Cloudflare, Amazon Web Services, Fastly, and Google Cloud Platform enabled HTTP/2 to serve content for high-traffic sites like YouTube, Facebook, Twitter, Wikipedia, and Amazon (company). Enterprises and projects including WordPress, Drupal, Joomla, and Magento adapted tooling, while observability vendors like New Relic and Datadog monitored performance impacts. Adoption metrics tracked by independent analysis groups and companies such as W3Techs and Netcraft showed rapid growth in the years following standardization.

Performance and Security Considerations

Performance benefits—reduced latency, fewer TCP connections, and better resource utilization—were measured in studies by Akamai, Cloudflare, and academic teams at University of Cambridge and Princeton University. However, implementation choices affect outcomes: header compression (HPACK) requires careful handling to avoid information leakage described in security advisories from CERT and vendors including Google and Mozilla Foundation. Use of HTTP/2 over TLS is common in practice on platforms such as Cloudflare and Amazon (company), and guidance from IETF and cryptographic researchers at Ecole Polytechnique Fédérale de Lausanne influenced recommendations to use modern cipher suites. Attack vectors like stream exhaustion and priority manipulation prompted mitigations in server implementations by nginx, Apache, and HAProxy and security analyses from groups like OWASP.

Implementations and Support

Multiple open-source and commercial implementations exist. Servers supporting the protocol include nginx, Apache HTTP Server, Microsoft IIS, Caddy (web server), HAProxy, and Envoy (software). Client libraries and toolchains with implementations include curl, OpenSSL, BoringSSL, LibreSSL, Node.js, Go (programming language), and Python (programming language) ecosystems. Large-scale operators such as Google LLC, Facebook, Amazon (company), Cloudflare, and Akamai contributed test suites and interoperability reports. Research into successor protocols and related technologies continued in forums attended by representatives from IETF, W3C, Mozilla Foundation, and major platform providers.

Category:Internet protocols