Cybersecurity glossary
What is HTTP/3?
Learn what HTTP/3 is, how it runs over QUIC instead of TCP, which performance gains to expect, and what operators should verify for TLS, UDP, and fallback behavior.
Definition
HTTP/3 is the third major version of HTTP that maps HTTP semantics onto QUIC, a UDP-based multiplexed transport with integrated TLS 1.3, reducing connection latency and avoiding TCP head-of-line blocking.
Why HTTP/3 matters
HTTP/2 multiplexed many streams onto one TCP connection, but a single lost TCP packet could still stall all of them. On mobile networks with loss and changing paths, that head-of-line blocking hurts real users.
HTTP/3 keeps HTTP semantics while changing the transport: QUIC over UDP provides independent streams, faster handshakes with integrated TLS 1.3, and better connection migration when devices switch networks.
How HTTP/3 connections start
Client connects with TCP HTTP first (often)
Many first visits still use HTTP/2 or HTTP/1.1 while discovering HTTP/3 support.
Server advertises h3
Alt-Svc or equivalent signals tell the client that HTTP/3 is available on UDP.
Client opens a QUIC connection
UDP packets carry a QUIC handshake that includes TLS 1.3 authentication and keys.
HTTP/3 frames ride QUIC streams
Requests and responses are multiplexed without TCP’s cross-stream blocking on loss.
Subsequent visits may go h3 directly
Cached Alt-Svc knowledge lets later connections skip straight to QUIC when allowed.
Fallback remains available
If UDP is blocked, clients continue with TCP-based HTTP versions.
HTTP/3 vs HTTP/2
| Property | HTTP/2 | HTTP/3 |
|---|---|---|
| Transport | TCP | QUIC over UDP |
| Encryption | TLS usually negotiated separately | TLS 1.3 integrated into QUIC |
| Loss impact | TCP loss can block all streams | Streams are independent at transport layer |
| Connection migration | Tied to TCP 4-tuple | Connection IDs can survive path changes |
| Middlebox familiarity | High—TCP everywhere | Lower—UDP/443 policies vary |
Benefits and operational realities
Faster connection setup
Combined cryptographic and transport handshake can reduce round trips versus older stacks.
Smoother performance under loss
One dropped packet is less likely to freeze every asset on the page.
Edge-first adoption
CDNs and load balancers often enable h3 long before every origin speaks QUIC natively.
New observability needs
Packet captures and some firewalls see less cleartext; tooling must understand QUIC.
Security considerations
Mandatory modern crypto
QUIC’s design assumes TLS 1.3-class protection—no opportunistic cleartext HTTP/3.
Implementation attack surface
New stacks mean new CVEs in QUIC parsers and HTTP/3 framing—patch promptly.
UDP amplification awareness
Validate address ownership and rate-limit as with other UDP protocols.
Consistent policy across protocols
WAF, auth, and header rules must apply equally on h3 and TCP HTTP fallbacks.
Adoption checklist
- Enable HTTP/3 at the edge only after UDP/443 is permitted on relevant networks.
- Advertise Alt-Svc correctly and monitor how often clients successfully use h3.
- Keep HTTP/2 and HTTP/1.1 healthy as fallbacks with identical security policy.
- Confirm certificates and TLS settings behave as expected for QUIC handshakes.
- Update WAF, bot, DDoS, and logging pipelines to understand HTTP/3 traffic.
- Load-test under packet loss—not only on clean datacenter links.
- Watch CPU and memory: userspace QUIC stacks can shift cost versus kernel TCP.
- Document rollback steps if a QUIC implementation CVE or middlebox issue appears.
The practical takeaway
HTTP/3 delivers familiar HTTP semantics over QUIC, improving connection setup and resilience on lossy networks while mandating modern encryption. It is a transport upgrade more than an application redesign.
Roll it out at the edge with solid fallbacks, UDP readiness, and equal security controls across protocols. Users benefit when h3 works—and should never notice when it safely falls back.
Related security terms
QUIC
The UDP-based transport that carries HTTP/3.
HTTP/2
The previous multiplexed HTTP version that still runs over TCP.
HTTP/1.1
The textual baseline protocol still used as a universal fallback.
SSL/TLS
Cryptography integrated into QUIC for HTTP/3 (TLS 1.3).
Content Delivery Network (CDN)
Where many sites first enable HTTP/3 at the public edge.
Frequently asked questions
What is HTTP/3 in simple terms?
It is the newest common way browsers talk HTTP, running on QUIC over UDP instead of TCP. Pages can load more smoothly on lossy networks because one lost packet does not stall every stream.
Does HTTP/3 replace HTTPS?
No. HTTP/3 still provides HTTP semantics and always uses encryption via QUIC’s TLS 1.3 handshake. Users still see https:// URLs.
Why does HTTP/3 use UDP?
QUIC is built on UDP so it can implement its own reliable streams, congestion control, and connection migration without waiting for OS TCP changes.
Will HTTP/3 always be faster?
Often better on lossy mobile networks and for connection setup, but gains vary. Misconfigured UDP blocking or CPU overhead can erase benefits.
How do clients discover HTTP/3?
Typically after an initial HTTP/1.1 or HTTP/2 response advertising Alt-Svc (or similar discovery), then later connections may use h3 directly.
Is HTTP/3 more secure than HTTP/2?
It mandates modern crypto in QUIC and removes some TCP-era issues, but security still depends on implementation quality, certificate validation, and application logic.
Do firewalls break HTTP/3?
Yes, if they block or throttle UDP/443. Clients usually fall back to TCP-based HTTP/2 or HTTP/1.1.
References
Explore authoritative guidance and frameworks related to http/3.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.