RFC 7540

RFC 7540
Title	RFC 7540
Status	Published
Authors	Mark Nottingham, Julian Reschke
Year	2015
Type	Internet standard
Series	RFC

RFC 7540 is the Internet Engineering Task Force specification that defines the second major version of the HTTP protocol, commonly known as HTTP/2. It updates and replaces elements of earlier specifications to provide improved performance, multiplexing, header compression, and more efficient use of network resources. The document was developed within the IETF working groups and influenced by implementations and experiments from major technology organizations and web platform vendors.

Introduction

RFC 7540 formalizes an application-layer protocol used by clients and servers for distributed hypermedia communication, building on precedents set by earlier standards and implementations. It addresses limitations observed in deployments tied to World Wide Web Consortium, Internet Engineering Task Force, Tim Berners-Lee, Vint Cerf, and industry projects led by companies such as Google (company), Mozilla, Microsoft, Apple Inc., and Facebook. The specification articulates framing, stream management, and header encoding techniques that respond to performance challenges documented in research by institutions like Stanford University, Massachusetts Institute of Technology, University of California, Berkeley, and Carnegie Mellon University.

History and Development

The work leading to RFC 7540 emerged from proposals and experimental implementations that trace through efforts by Google (company) with its SPDY project, contributions from engineers associated with Mozilla, Opera Software, and input from the IETF HTTP Working Group. Development milestones involved community review processes that included participants from World Wide Web Consortium, European Union, and corporate stakeholders such as Amazon (company), Akamai Technologies, Cloudflare, and Netflix, Inc.. The document passed through IETF consensus and publication stages overseen by bodies like the Internet Society and editorial review by authors including contributors from IETF],] with contemporaneous discussion at events such as the Internet Engineering Task Force meeting and presentations at conferences including SIGCOMM and USENIX. RFC 7540 reflects interoperability testing and revisions influenced by experimental deployments on platforms run by Google (company), Twitter, Inc., YouTube, LinkedIn, and major web hosting providers.

Technical Overview

RFC 7540 defines a binary framing layer that organizes messages into frames, streams, and connections. The design contrasts with the textual format of earlier specifications developed in contexts involving Tim Berners-Lee and historical protocols standardized under the auspices of IETF and the World Wide Web Consortium. Key technical constructs include stream identifiers, frame types, and flow control mechanisms that reference algorithmic concepts explored at institutions like Massachusetts Institute of Technology and Princeton University. The specification prescribes mandatory and optional frame types, state machines for stream lifecycles, and rules for connection management that informed implementations by projects such as nghttp2, OpenSSL, and stacks used by Nginx and Apache HTTP Server.

Protocol Features

RFC 7540 introduced features intended to reduce latency and improve resource utilization: multiplexing concurrent exchanges over a single TCP connection, stream prioritization, header compression using HPACK, and server push capabilities. These features echo optimizations experimented with by Google (company)'s SPDY and informed by performance studies from Akamai Technologies, Cloudflare, and university labs such as Carnegie Mellon University. The HPACK header compression mechanism addresses compression side-channel concerns noted in security research from institutions like University of California, Berkeley and Stanford University, while stream prioritization enables resource allocation strategies utilized in server architectures deployed by Amazon (company) and Netflix, Inc..

Security Considerations

RFC 7540 contains discussion of security implications including interaction with transport-layer security, connection state management, denial-of-service risks from resource exhaustion, and header compression side channels. The specification reflects threat analyses similar to those conducted by teams at Google (company), Mozilla, Microsoft, and academic groups at Harvard University and University of California, Berkeley. Guidance covers TLS negotiation patterns compatible with Transport Layer Security extensions, and mitigations against amplification and flow-control abuse relevant to operators like Cloudflare and Akamai Technologies. The document informed follow-up work in other IETF efforts addressing related security and privacy topics.

Implementation and Deployment

Multiple open-source and commercial projects implemented RFC 7540, including server and client stacks maintained by nginx, Apache HTTP Server, nghttp2, OpenSSL, BoringSSL, and browser vendors such as Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari. Cloud and content delivery networks operated by Cloudflare, Akamai Technologies, Amazon Web Services, and hosting providers like GitHub and DigitalOcean deployed support to accelerate web traffic. Interoperability testing involved organizations such as IETF, World Wide Web Consortium, and corporate labs from Google (company), Facebook, and Twitter, Inc..

Impact and Adoption

RFC 7540 significantly influenced web architecture and performance practices adopted by major platforms including Google (company), Facebook, Amazon (company), Netflix, Inc., and browser vendors like Mozilla and Apple Inc.. Its introduction changed content delivery strategies at providers such as Akamai Technologies and Cloudflare, and shaped subsequent protocol work in the IETF and academic research at institutions like Stanford University and Carnegie Mellon University. The specification paved the way for successor transport and multiplexing research pursued by groups working on protocols associated with QUIC and later IETF documents, and remains a milestone in the evolution of Internet application protocols.

Category:Internet protocols