HTTP/3 & QUIC

Also Known As

TL;DR

Explanation

HTTP/2 over TCP has head-of-line blocking: a single lost packet stalls all multiplexed streams. HTTP/3 uses QUIC (Quick UDP Internet Connections) — each stream is independent, a lost packet only affects that stream. QUIC also combines TLS handshake with the connection handshake (0-RTT or 1-RTT vs TCP+TLS 3-RTT), dramatically reducing connection setup time. PHP servers: Caddy and nginx (with QUIC patch) support HTTP/3. CDNs (Cloudflare, Fastly) front-end HTTP/3 transparently. Impact is most significant for mobile users on lossy networks.

Common Misconception

Why It Matters

Common Mistakes

• Not serving Alt-Svc header — clients need to discover HTTP/3 support before upgrading.
• Assuming HTTP/3 is always faster — on good networks the difference is small; the benefit is on lossy mobile connections.
• Not testing HTTP/3 connectivity — use curl --http3 to verify it works end-to-end.
• Forgetting UDP firewall rules — QUIC uses UDP port 443 which may be blocked by corporate firewalls.

Code Examples

// nginx without HTTP/3 — missing performance on mobile:
server {
    listen 443 ssl http2;
    # No QUIC/HTTP3 support
    # Mobile users on lossy networks get HTTP/2 head-of-line blocking
}

# nginx with HTTP/3 (nginx-quic build):
server {
    listen 443 ssl http2;
    listen 443 quic reuseport;  # HTTP/3 on UDP

    ssl_protocols TLSv1.3;      # QUIC requires TLS 1.3

    # Advertise HTTP/3 support:
    add_header Alt-Svc 'h3=":443"; ma=86400';

    # Or use Cloudflare/Fastly CDN:
    # They handle HTTP/3 termination automatically

References

• ↗ https://www.chromium.org/quic/
• ↗ https://developers.cloudflare.com/http3/

Tags

Related Terms