Web Protocols

HTTP/3

HTTP carried over QUIC and UDP rather than TCP — independent streams end transport head-of-line blocking, and built-in TLS 1.3 plus 0-RTT slash connection setup latency.

What it is

HTTP/3 (RFC 9114) keeps HTTP/2's semantics but swaps the transport: it runs on QUIC, which rides UDP. Because each QUIC stream is independent, a lost packet only stalls its own stream, not all of them. QUIC folds in TLS 1.3, so the handshake is faster and supports 0-RTT resumption.

How it is discovered

A client usually starts on HTTP/1.1 or HTTP/2 and learns HTTP/3 is available from an Alt-Svc response header, then upgrades on the next connection.

ALT-SVC HEADER
Alt-Svc: h3=":443"; ma=86400

Why it matters

  • Independent streams end the TCP head-of-line blocking that limited HTTP/2 on lossy networks.
  • Connection migration keeps a session alive across network changes (Wi-Fi to cellular).

Common mistakes

  • Blocking UDP/443 at the firewall, which silently prevents HTTP/3 and forces a TCP fallback.
  • Expecting HTTP/3 on the first request — it is advertised via Alt-Svc and used on a later connection.

How WebInspect checks this

  • WebInspect detects HTTP/3 support via the Alt-Svc header and reports it in the protocols section.