HTTP/1.1, HTTP/2 and HTTP/3: the differences an operator notices

What it is

HTTP/1.1 (RFC 9112) frames messages as text: a request line, header lines, an optional body delimited by Content-Length or chunked transfer coding. Connections are persistent by default, but responses must come back in request order, so clients wait or open several connections. HTTP/2 (RFC 9113) keeps the same semantics but uses binary frames, many concurrent streams on one connection, HPACK header compression and flow control per stream. It is negotiated through ALPN as h2 on TLS; cleartext h2c exists only with prior knowledge, as the RFC deprecates the Upgrade path. HTTP/3 (RFC 9114) carries the same semantics over QUIC, a UDP-based transport with TLS 1.3 built in; each request stream is delivered independently, so a lost packet delays only its own stream, and headers use QPACK, which limits the head-of-line blocking that compression could cause. Clients learn about an HTTP/3 endpoint from an Alt-Svc header (RFC 9114) or from an HTTPS DNS record (RFC 9460) and should fall back to TCP-based HTTP if the QUIC connection fails, for example because UDP is blocked.

Why it matters

The version changes what the operator must configure and can observe. HTTP/2 concentrates a browser's traffic on one connection, so one connection reset or one slow TCP retransmission stalls every stream at once; connection limits per client mean something different than with HTTP/1.1. HTTP/3 means the advertised UDP port (RFC 9114 allows any port; Alt-Svc always names it explicitly) must be open in firewalls, security groups and load balancers, and packet captures show encrypted UDP rather than readable TLS records.

How to apply

• Terminate HTTP/2 and HTTP/3 at the edge (reverse proxy or load balancer) and speak HTTP/1.1 to application servers unless they benefit from multiplexing; this keeps the application's connection handling simple.
• Advertise HTTP/3 only after UDP reachability is tested from outside; a wrong Alt-Svc costs clients a failed attempt before they fall back.
• Keep per-stream limits (SETTINGS_MAX_CONCURRENT_STREAMS) and request-body limits in the proxy; multiplexing makes one client able to open many requests cheaply.
• Log the negotiated protocol per request so that version-specific problems can be separated in the access log.

Pitfalls

Header names are lower-case in HTTP/2 and HTTP/3 and some headers (Connection, Transfer-Encoding) are forbidden; middleware that rewrites headers must handle both forms. RFC 9113 notes that the cleartext Upgrade path was never widely deployed; browsers speak HTTP/2 only over TLS with ALPN, so h2c is a server-to-server option. QUIC connection IDs allow a client to change address mid-connection, which stateless load balancing by 4-tuple does not handle.