HTTP/3

HTTP/3
Name	HTTP/3
Status	Standardized
Developer	Internet Engineering Task Force QUIC Working Group
Initial release	2022
Latest release	2022
Preceding protocol	HTTP/2
Transport	QUIC
Application layer	Hypertext Transfer Protocol
License	RFC-based

HTTP/3 HTTP/3 is the third major version of the Hypertext Transfer Protocol family, specified alongside QUIC by the Internet Engineering Task Force QUIC Working Group. It modernizes web communication by replacing traditional Transmission Control Protocol reliance with a transport designed for low latency and multiplexing. Major standards bodies, browser vendors, and cloud providers coordinated specification, experimentation, and deployment during a period of rapid adoption across content delivery networks and service providers.

Overview

HTTP/3 is an application-layer protocol intended to transmit Hypertext Transfer Protocol semantics over a transport that combines features of User Datagram Protocol and encrypted sessions developed by the Independent Working Group of the IETF. The design emphasizes reduced connection establishment latency, improved multiplexing without head-of-line blocking, and integration with connection migration features found in QUIC implementations. Stakeholders in specification and deployment included major browser projects such as Google Chrome, Mozilla Firefox, Apple Safari, and platform vendors including Microsoft, cloud providers like Amazon Web Services, Google Cloud Platform, and Microsoft Azure, as well as content delivery networks such as Cloudflare, Akamai Technologies, and Fastly.

History and development

Work toward HTTP/3 grew from performance limitations observed in HTTP/1.1 and HTTP/2, and from transport experimentation by organizations like Google LLC with its spinoff protocol QUIC in the mid-2010s. The IETF formed the QUIC Working Group to standardize QUIC and coordinate the corresponding HTTP mapping. Key standards milestones involved IETF drafts and RFC publications where contributors included engineers from Google, Facebook, Mozilla Foundation, Cloudflare, Akamai, Apple Inc., and academic groups at institutions such as Massachusetts Institute of Technology, Stanford University, and University of California, Berkeley. Public experiments and blog posts by Google and evaluations from research groups at University of Cambridge and ETH Zurich informed revisions to congestion control and encryption model choices. Industry adoption accelerated after formal publication and integrations in browsers and servers, mirroring earlier transitions from HTTP/1.1 to HTTP/2.

Protocol design and features

HTTP/3 maps HTTP semantics—methods, headers, status codes originating from the World Wide Web Consortium and IETF HTTP Working Group lineage—onto streams provided by QUIC. Unlike Transmission Control Protocol, QUIC builds in encryption akin to Transport Layer Security and provides stream multiplexing that avoids head-of-line blocking experienced in HTTP/2 over TCP. Connection establishment benefits from reduced round-trips, drawing on ideas from TLS 1.3 to permit 0-RTT and 1-RTT handshakes, with influence from QUIC drafts and tuned congestion control algorithms like those developed in research from IETF TCPM Working Group and academic labs. HTTP/3 retains HTTP semantics such as methods (GET, POST), header compression approaches inspired by HPACK and QPACK, status codes rooted in earlier RFCs, and frame models compatible with existing web infrastructure like Content Delivery Network caches. The protocol design also contemplates connection migration to support mobile scenarios involving carriers such as AT&T, Verizon Communications, and T-Mobile US.

Deployment and adoption

Major browser vendors included HTTP/3 support in releases of Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari, which accelerated server-side uptake by projects like Nginx, Envoy (software), HAProxy, and Apache HTTP Server. Cloud providers and CDNs such as Cloudflare, Akamai Technologies, Fastly, Amazon Web Services, Google Cloud Platform, and Microsoft Azure offered managed endpoints and experimental flags. Platform and device makers in ecosystems including Android (operating system), iOS, and major operating system distributors such as Red Hat and Debian added libraries and packages to ease adoption. Enterprises and services—ranging from social networks like Facebook and Twitter to streaming platforms such as Netflix and YouTube—evaluated HTTP/3 to reduce page load times and improve resilience under network variability.

Performance and measurements

Empirical evaluations by research groups at Stanford University, University College London, ETH Zurich, and industry labs at Google and Cloudflare measured latency, throughput, and loss recovery. Measurements commonly show improvements in page load metrics and tail latency under lossy or mobile networks, especially for connection-heavy workloads and multiplexed resources. Benchmarks comparing TCP+TLS 1.3 stacks to QUIC-based HTTP/3 demonstrate fewer retransmission stalls and faster handshake completion in many scenarios; however, real-world gains depend on network topology, middlebox interactions studied by RIPE NCC and IETF measurement efforts, and congestion control tuned by contributors from IETF and the Networking Research Group community.

Security and privacy considerations

HTTP/3 inherits encryption and authentication properties from integrated QUIC and TLS 1.3 mechanisms, reducing exposure to passive eavesdropping and certain middlebox-based attacks analyzed by researchers at CERN and University of Oxford. The protocol design raises considerations about 0-RTT replay risks documented by IETF security discussions and necessitates key management practices from operators like Cloudflare and Akamai Technologies. Privacy-focused organizations such as Electronic Frontier Foundation and IETF Privacy Considerations contributors examined potential metadata leakage from connection identifiers and migration features; mitigations include connection ID designs, tokenization approaches, and operational guidance adopted by major vendors.

Implementations and interoperability

Multiple open-source and commercial implementations exist, including libraries and servers such as quiche (Cloudflare project), ngtcp2, lsquic, BoringSSL, OpenSSL, BoringSSL forks, and integrations in Nginx, Envoy (software), HAProxy, Apache HTTP Server, and proprietary stacks used by Google and Apple Inc.. Testing and interoperability events coordinated by the IETF and community groups like Interop Working Group helped surface edge cases, with test suites contributed by vendors and academic labs at Massachusetts Institute of Technology and University of Cambridge. Ongoing work in standards and implementations continues through IETF QUIC Working Group efforts and vendor collaboration in the broader web community.

Category:Internet protocols