Web Protocols

ALPN (Application-Layer Protocol Negotiation)

The quiet TLS extension that lets a client and server agree on HTTP/2 versus HTTP/1.1 inside the TLS handshake — with zero extra round trips. Without it, browser HTTP/2 would not exist.

What it is

ALPN (RFC 7301) is a TLS handshake extension in which the client offers a list of protocols it supports (e.g. h2, http/1.1) and the server picks one. Because it happens during the existing TLS handshake, protocol selection costs no additional round trip. Browsers require ALPN to use HTTP/2.

OBSERVE ALPN
openssl s_client -connect example.com:443 -alpn h2,http/1.1 </dev/null 2>/dev/null | grep -i alpn

Why it matters

  • It is the mechanism that makes browser HTTP/2 possible at no latency cost.
  • A misconfigured ALPN list silently forces clients down to HTTP/1.1.

Common mistakes

  • Server TLS configs that omit h2 from the ALPN list, disabling HTTP/2 without any error.

How WebInspect checks this

  • WebInspect reports the ALPN-negotiated protocol as part of its TLS and protocol analysis.