Web Protocols

QUIC (Quick UDP Internet Connections)

The modern transport under HTTP/3: multiplexed streams with independent loss recovery, TLS 1.3 baked in, 0-RTT resumption and connection migration — all on top of UDP.

What it is

QUIC (RFC 9000) is a transport protocol built on UDP that delivers what TCP+TLS did, but better integrated. It provides many independent streams (no cross-stream head-of-line blocking), encrypts everything with TLS 1.3 as part of the transport handshake, and identifies connections by a Connection ID rather than the IP/port 4-tuple, so a connection survives a network change.

One handshake, not two

TCP then TLS is two sequential handshakes. QUIC combines transport and cryptographic setup into one, cutting a full round trip — and 0-RTT can send data on the very first packet for resumed connections.

Why it matters

  • Independent streams and faster setup make it materially quicker than TCP+TLS, especially on mobile and lossy links.
  • Connection migration keeps sessions alive across IP changes.

Common mistakes

  • Assuming UDP is unreliable — QUIC implements its own loss detection and retransmission on top of UDP.
  • Ignoring that middleboxes and firewalls sometimes throttle or block UDP, requiring a TCP fallback.

How WebInspect checks this

  • WebInspect infers QUIC availability from HTTP/3 advertisement and reports transport details.