HTTP/3 Cover Giacomo Lanzi

HTTP / 3, everything you need to know about the latest version protocol

Estimated reading time: 5 minutes

Security researchers have just digested the HTTP / 2 protocol, but web innovators are already publishing an update: HTTP / 3. This technology offers performance gains and security benefits, but only if we overcome the implementation problems that await us for what appears to be an evolutionary change rather than a real revolution in the way the web works.

In this article I will try to clarify what the new HTTP / 3 protocol is, what its features are and how you can implement them to your web hosting through Cloudflare with the services offered by SOD. < / p>

HTTP/3 fast network

What is HTTP/3 in detail

HTTP / 3 is a major update of the HyperText Transfer Protocol (HTTP), the technology that underlies the transfer of information on the web. HTTP / 3 runs on QUIC, an encrypted general transport protocol that “bundles” multiple data streams on a single connection.

QUIC was initially developed by Google and uses congestion control on User Datagram Protocol (UDP).

What is the relationship with HTTP/2?

HTTP / 2 has brought some improvements through non-blocking download technology, pipelining and server push that help overcome some limitations of the underlying TCP protocol HTTP / 2 as well as HTTP. Basically, with HTTP / 2 we can minimize the number of request – response cycles between client and server .

HTTP / 2 made it possible to send more than one resource on a single TCP connection, a process called multiplexing . The protocol provides greater flexibility in the order of static downloads and pages are no longer constrained by a linear progression of downloads.

It is possible to think of HTTP / 3 as the previous protocol which instead of using TCP for the transfer, uses QUIC, the protocol we mentioned above.

The benefits of the new protocol

The move to QUIC goes a long way towards solving one of the major HTTP/2 problems , namely “head of line blocking”, literally blocking the beginning of the line .

Since the parallel nature of HTTP/2 multiplexing is not visible to TCP’s loss recovery mechanisms, a lost or reordered packet causes all active transactions to stall , regardless of the whether or not a particular transaction was affected by the lost packet.

Since QUIC provides native multiplexing , lost packets only impact the streams in which the data was affected . The practical effect of upgrading to HTTP/3 is to reduce the latency of poor internet connections or frequent packet losses.

Furthermore, QUIC is almost entirely encrypted, which means that security is significantly improved with HTTP/3 . This built-in encryption means fewer opportunities for MitM ( manipulator-in-the-middle ) attacks. QUIC also includes other features that help protect against denial of service (DoS) exploits, which we discussed in another article in relation to ransomware.

QUIC combines its encrypted handshake and transport to allow connection to a new server in a single request . The same technology allows you to quickly resume a broken connection with the client sending encrypted application data in the first interaction. The protocol uses TLS 1.3 as a building block in its encrypted handshake.

Support for the new protocol

As of March 2021, the HTTP/3 protocol is still a standard draft and already has multiple implementations. Currently around 14.3% of the 10 million websites in existence support HTTP/3. For comparison, HTTP/2 is supported by 50.5% of platforms. Data source is W3Techs .

As far as browsers are concerned, the protocol is supported by stable versions of Chrome in a non-default way (from December 2019) and by Firefox (from January 2020).

HTTP/3 Secure connections

The benefits of introducing HTTP/3

HTTP/3 should offer faster load times and better performance for websites, particularly on networks prone to frequent packet loss, than previous technologies.

Achiel van der Mandele, Cloudflare product manager explained: “ In a nutshell, we believe that HTTP/3 will make the internet better for everyone . HTTP/3 is the successor to HTTP/2, which offers better performance when loading websites.

“HTTP/3 users will benefit from faster connection setup and better performance on poor quality networks with high amounts of packet loss. Both of these improvements ensure that websites are load faster and more reliably, “Mandele told The Daily Swig .

Web protocol expert Robin Marx was more cautious about the benefits of HTTP/3:

“Performance should also benefit, albeit not by much in practice,” he said. “Removing the head-of-line block doesn’t matter that much for [things like] loading web pages.

“Most of the gains will come from shorter handshake setup times,” he explained, adding that HTTP/3 and QUIC are “an evolution, not a revolution” .

“Performance will be better, but not in a super noticeable way for things like web browsing,” Marx said. “ Security should be better and protect against different types of attacks “. ( Source )

Availability of the protocol

As we have seen, the new HTTP / 3 transfer protocol could be a notable evolution in security rather than performance, where it will significantly excel in setting handshakes . Not all hosting services are currently able to offer support for the new protocol.

We at SOD offer this through Cloudflare, our partner for CDNs. In our web hosting service it is possible to enable CDN for free and then set up support for the new HTTP / 3 via the Cloudflare panel itself.

For more information, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

Useful links:

CloudFlare

Install a Let’s Encrypt certificate on Debian based machine

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • APPLE-SA-12-11-2024-9 Safari 18.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-9 Safari 18.2 Safari 18.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121846. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Safari Available for: macOS Ventura and macOS Sonoma Impact: On a […]
  • APPLE-SA-12-11-2024-8 visionOS 2.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-8 visionOS 2.2 visionOS 2.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121845. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Crash Reporter Available for: Apple Vision Pro Impact: An app may […]
  • APPLE-SA-12-11-2024-7 tvOS 18.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-7 tvOS 18.2 tvOS 18.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121844. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegrity Available for: Apple TV HD and Apple TV 4K (all […]
  • APPLE-SA-12-11-2024-6 watchOS 11.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-6 watchOS 11.2 watchOS 11.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121843. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegrity Available for: Apple Watch Series 6 and later Impact: A […]
  • APPLE-SA-12-11-2024-5 macOS Ventura 13.7.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-5 macOS Ventura 13.7.2 macOS Ventura 13.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121842. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Software Restore Available for: macOS Ventura Impact: An […]
  • APPLE-SA-12-11-2024-4 macOS Sonoma 14.7.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-4 macOS Sonoma 14.7.2 macOS Sonoma 14.7.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121840. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Software Restore Available for: macOS Sonoma Impact: An […]
  • APPLE-SA-12-11-2024-3 macOS Sequoia 15.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-3 macOS Sequoia 15.2 macOS Sequoia 15.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121839. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. Apple Software Restore Available for: macOS Sequoia Impact: An […]
  • APPLE-SA-12-11-2024-2 iPadOS 17.7.3 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-2 iPadOS 17.7.3 iPadOS 17.7.3 addresses the following issues. Information about the security content is also available at https://support.apple.com/121838. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. FontParser Available for: iPad Pro 12.9-inch 2nd generation, iPad Pro 10.5-inch, […]
  • APPLE-SA-12-11-2024-1 iOS 18.2 and iPadOS 18.2 December 12, 2024
    Posted by Apple Product Security via Fulldisclosure on Dec 12APPLE-SA-12-11-2024-1 iOS 18.2 and iPadOS 18.2 iOS 18.2 and iPadOS 18.2 addresses the following issues. Information about the security content is also available at https://support.apple.com/121837. Apple maintains a Security Releases page at https://support.apple.com/100100 which lists recent software updates with security advisories. AppleMobileFileIntegrity Available for: iPhone XS […]
  • SEC Consult SA-20241211-0 :: Reflected Cross-Site Scripting in Numerix License Server Administration System Login December 12, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Dec 12SEC Consult Vulnerability Lab Security Advisory < 20241211-0 > ======================================================================= title: Reflected Cross-Site Scripting product: Numerix License Server Administration System Login vulnerable version: 1.1_596 fixed version: - CVE number: CVE-2024-50585 impact: medium homepage: https://connect.numerix.com/nlslogin.jsp...

Customers

Newsletter

{subscription_form_1}