Cybersecurity glossary
What is HTTP/2?
Learn what HTTP/2 is, how binary framing and multiplexing improve web performance, which security considerations matter, and how it relates to HTTPS and older HTTP/1.1 deployments.
Definition
HTTP/2 is a major revision of the Hypertext Transfer Protocol that uses a binary, multiplexed framing layer so many requests and responses can share one connection efficiently, typically negotiated over TLS for web browsing.
Why HTTP/2 matters
HTTP/1.1 carried the web for a long time, but modern pages request dozens or hundreds of objects. Browsers compensated with many parallel connections, which added overhead and head-of-line blocking at the application layer.
HTTP/2 redesigns how HTTP messages move on the wire: binary frames, streams, and multiplexing on a single connection. For users, pages can feel snappier. For operators, TLS termination, load balancers, WAFs, and observability must understand the new framing.
How HTTP/2 works
Negotiate the protocol
Over TLS, ALPN commonly selects h2. Cleartext upgrades exist but are rare for public browsers.
Establish a binary session
Peers communicate with frames rather than plain-text HTTP/1.1 message formatting.
Multiplex streams
Many request/response exchanges share one connection as independent streams.
Compress headers with HPACK
Repetitive headers shrink using a controlled compression format designed for HTTP headers.
Apply flow control and priorities
Stream flow control manages memory; priority signals (evolving over time) influence scheduling.
Deliver application HTTP semantics
Methods, status codes, and headers remain HTTP—only the transport framing changed.
HTTP/2 vs HTTP/1.1
| Property | HTTP/1.1 | HTTP/2 |
|---|---|---|
| On-wire format | Textual messages | Binary frames |
| Parallelism | Often multiple connections; limited pipelining | Many streams on one connection |
| Header overhead | Repeated large headers per request | HPACK compression reduces repetition |
| Browser deployment | Universal fallback | Typically over HTTPS with ALPN |
Security considerations
TLS still decides confidentiality
Enable modern TLS versions and ciphers; HTTP/2 does not replace transport security.
Implementation complexity
Framing, compression, and stream state machines expand parser attack surface.
WAF and logging parity
Ensure security tools see HTTP/2 requests with the same fidelity as HTTP/1.1.
Abuse and DoS
Stream floods, header attacks, and compression bombs require server limits and patches.
Adoption checklist
- Enable HTTP/2 on TLS terminators that browsers reach; verify ALPN advertisement.
- Confirm CDNs, load balancers, and origin protocols are intentionally configured end to end.
- Keep HTTP/1.1 available for clients and tools that need it, with equal security policy.
- Validate WAF, bot management, and access logs parse HTTP/2 correctly.
- Apply vendor patches promptly for HTTP/2 implementation CVEs.
- Do not depend on server push for performance; use modern caching and resource strategies.
- Load-test multiplexing behavior under realistic parallel asset fetches.
- Monitor protocol negotiation ratios (h2 vs http/1.1) after cutover.
The practical takeaway
HTTP/2 modernizes HTTP transport with multiplexing and binary framing, usually delivered over HTTPS in browsers. It can improve performance and change how intermediaries must inspect traffic.
Adopt it with TLS best practices, tool parity, and DoS-aware server settings. Faster pages still need the same application security discipline as before—only the framing beneath them changed.
Related security terms
HTTPS
The common deployment mode in which browsers negotiate HTTP/2 over TLS.
SSL/TLS
The transport security layer that carries most real-world HTTP/2 web traffic.
HTTP Strict Transport Security (HSTS)
A complementary control that keeps users on HTTPS where HTTP/2 usually runs.
Web Application Firewall (WAF)
Edge components that must correctly parse HTTP/2 when protecting applications.
Frequently asked questions
What is HTTP/2 in simple terms?
HTTP/2 is a faster way for browsers and servers to speak HTTP. It can send many files over one connection at the same time instead of opening many separate connections like older HTTP/1.1 often did.
Does HTTP/2 require HTTPS?
The protocol can run over cleartext (h2c) in some setups, but major browsers effectively require TLS and negotiate HTTP/2 with ALPN. In practice, public websites use HTTP/2 over HTTPS.
How does HTTP/2 improve performance?
Multiplexing, binary framing, header compression (HPACK), and fewer connections reduce latency and overhead for pages with many resources.
Is HTTP/2 more secure than HTTP/1.1?
HTTP/2 is not a substitute for TLS. Security depends on TLS configuration, application logic, and correct parsing. HTTP/2 does introduce new implementation attack surface in framing and compression.
What happened to HTTP/2 server push?
Server push saw limited success and has been disabled or removed in major browsers. Do not build new performance strategies around it.
Should teams still care about HTTP/1.1?
Yes. Many APIs, health checks, legacy clients, and intermediary tools still use HTTP/1.1. Support both thoughtfully during migration.
What is ALPN?
Application-Layer Protocol Negotiation is a TLS extension used to select HTTP/2 (h2) versus other protocols during the handshake.
References
Explore authoritative guidance and frameworks related to http/2.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.