HTTP/3
HTTP over QUICHTTP/3 is HTTP/2’s multiplexing, finally done properly. It keeps the same semantics and streams but runs on QUIC over UDP instead of TCP, so loss on one stream does not stall every other stream and the connection survives a change of network entirely.
HTTP/3 moves HTTP onto QUIC — no TCP connection-wide head-of-line blocking, a faster handshake, and a session that follows you between networks.
How it works
Header compression rebuilt for QUIC streams; a stream can still wait for referenced table updates, but not for unrelated packet delivery.
A server advertises h3 over its HTTP/2 response; the browser upgrades on the next visit.
Wi-Fi to cellular keeps the same connection ID — the download doesn’t restart.
The application layer barely changed: the same methods, headers and status codes ride on a transport that finally matches how the web actually behaves — and clients keep a TCP path ready in case UDP 443 is blocked.
What HTTP/3 does, step by step
An Alt-Svc header or an HTTPS DNS record tells the client that h3 is available on UDP 443.
One round trip sets up transport and TLS 1.3 together — or zero, resuming a previous session.
Each request takes its own QUIC stream, headers compressed with QPACK.
Missing data is recovered without stalling unaffected streams, and the connection can survive an IP change.
In cybersecurity
HTTP/3 is encrypted end to end by construction — good for users, and a real change for anyone who relied on reading HTTP off the wire to defend a network.
HTTP content and most QUIC fields are encrypted; IP addresses, UDP ports, packet sizes and timing remain observable.
Appliances that parsed HTTP now see opaque UDP — inspection has to move to the endpoints.
Early data can be replayed, so only idempotent requests belong in it.
A server may not send much more than it received until the client’s address is validated.
Networks that block UDP 443 silently push everyone back to HTTP/2 — watch for the fallback.
XSS, CSRF and injection are untouched by any of this; they live above the transport.