gRPC
Remote Procedure Call over HTTP/2gRPC makes a network call look like calling a function. A .proto file defines the methods and message types, code is generated for both sides, and the call travels as a compact binary message over HTTP/2 — with streaming in either or both directions.
gRPC turns a contract into generated client and server code, carried as binary messages over HTTP/2 streams.
How it works
Because each call is its own HTTP/2 stream, a single connection carries many calls at once — and a method declared streaming keeps its stream open to send a sequence of messages rather than one.
What gRPC does, step by step
A .proto file declares the service, its methods and every message type, with numbered fields.
protoc produces a typed client stub and a server interface in whatever languages are involved.
The stub serialises the message and sends it as an HTTP/2 POST on a fresh stream.
The reply comes back on the same stream, followed by a grpc-status trailer saying whether it worked.
In cybersecurity
gRPC gets TLS and a typed schema for free, which removes whole classes of bug — but its binary framing hides it from most inspection tooling.
Channel credentials are the normal path; insecure channels are a deliberate opt-out.
Types validate shape, not permission — check who may call each method.
A call without a deadline can pin server resources indefinitely; propagate them across hops.
The default cap exists for a reason — raising it invites memory exhaustion.
Server reflection lets anyone enumerate every method you expose; disable it outside development.
Protobuf over HTTP/2 is unreadable to appliances expecting JSON — put checks in the service.