HTTP/3 and QUIC

HTTP/3 (RFC 9114) exists to kill HTTP/2's remaining weakness — TCP head-of-line blocking — by swapping the transport layer from TCP entirely to QUIC. HTTP's semantics (methods, status codes) are unchanged, but the substrate carrying them is completely different.

QUIC over UDP

QUIC (RFC 9000) is a reliable transport protocol implemented on top of UDP. UDP was chosen because routers and firewalls across the internet already pass it, so a new transport can be deployed in user space without replacing kernels or network gear. On top of UDP, QUIC provides its own stream multiplexing, loss recovery, congestion control, and encryption. Notably, TLS 1.3 is built into QUIC, so transport and encryption operate as one unit with no separate TLS layer.

1-RTT and 0-RTT handshakes

TCP+TLS stacked a TLS handshake on top of TCP's 3-way handshake, doubling up round trips. QUIC merges the transport and cryptographic handshakes so a first connection completes in 1-RTT. For a server you've reached before, cached session info enables 0-RTT, sending an HTTP request in the very first packet.

First connection (1-RTT):
  Client --- Initial (ClientHello) ------------> Server
  Client <-- Initial+Handshake (ServerHello) --- Server
  Client --- Handshake done + HTTP request -----> Server

Resumption (0-RTT):
  Client --- Initial + 0-RTT HTTP request ------> Server   (request in the first flight)

0-RTT is fast but its early data can be exposed to replay attacks, so servers only permit it for idempotent, safe requests like GET.

Per-stream loss recovery — no TCP HoL

This is QUIC's decisive advantage. QUIC streams manage ordering and loss recovery independently. If a packet on one stream is lost, other streams' data keeps flowing unaffected. In contrast to HTTP/2, which layered many logical streams over one TCP stream so a lost packet stalled everything, QUIC confines a loss to just its own stream. This eliminates transport-layer head-of-line blocking.

Connection migration

A TCP connection is identified by the src IP:port ↔ dst IP:port 4-tuple, so switching from Wi-Fi to cellular changes the IP and drops the connection. QUIC gives each connection an IP-independent Connection ID, so the same connection survives a network change (connection migration). The practical payoff: a download or call on mobile doesn't drop as you move.

QPACK and Alt-Svc discovery

HTTP/2's HPACK updated its header table in a way that depends on ordering, which doesn't hold across QUIC's independent streams. QPACK (RFC 9204) separates encoder/decoder streams and controls blocking to compress headers safely without an ordering guarantee. Separately, a client can't initially know a server speaks HTTP/3, so the server advertises it in an HTTP/1.1 or HTTP/2 response with an Alt-Svc header saying 'HTTP/3 is available here.'

HTTP/1.1 200 OK
Alt-Svc: h3=":443"; ma=86400

Deployment reality

Broad support: Major browsers and large CDNs/services already offer HTTP/3, and a substantial share of web traffic flows over it.
UDP-block fallback: Where enterprise networks or firewalls block UDP 443, clients silently fall back to HTTP/2 (TCP). So HTTP/3 is offered alongside HTTP/2 rather than replacing it.
First-visit cost: Because discovery goes through Alt-Svc, the first connection usually starts on HTTP/2 and is upgraded to HTTP/3 on subsequent visits.
CPU cost: Running congestion control and crypto in user space can raise server CPU load, so optimization matters at scale.