HTTP/3 and QUIC: secure streams over UDP

QUIC is a secure, multiplexed transport over UDP. HTTP/3 maps HTTP semantics onto QUIC request streams. TLS 1.3 supplies the cryptographic handshake, but QUIC carries handshake bytes in CRYPTO frames and applies its own packet protection rather than TLS record protection.

Mental model

• QUIC has packet-number spaces for encryption phases, not a separate packet-number space for every stream.
• Streams provide reliable in-order bytes within a stream and no delivery-order guarantee between streams.
• Connection IDs support routing and migration across address changes. Migration remains subject to endpoint policy, path validation, amplification limits, load-balancer design, and congestion control.
• HTTP/3 uses h3 ALPN and QPACK. If UDP connectivity fails, clients should attempt a TCP-based HTTP version.

Гарантии и границы

• HTTP/3 request-response pairs use client-initiated bidirectional QUIC streams.
• Loss on one stream does not inherently block application delivery on other streams, but shared congestion and connection controls remain.
• QUIC 0-RTT is optional, replayable, and rejectable.
• A Connection ID is not an authorization credential or proof of address ownership.

Сценарии диаграммы

QUIC and HTTP/3 establishment. QUIC carries TLS handshake bytes in CRYPTO frames, negotiates h3, and protects transport packets.

Stream loss isolation and remaining coupling. QUIC orders bytes per stream, so loss on one request stream does not inherently block delivery on another.

Connection migration with path validation. Connection IDs let an endpoint associate packets across address changes; a new path is validated before unrestricted use.

0-RTT, rejection, and TCP fallback. A returning client can offer early data, but the server may reject it and UDP connectivity can require a TCP-based HTTP version.

Архитектурные решения

• Deploy HTTP/3 alongside a tested TCP fallback and measure success by network class.
• Route QUIC by connection ID at every relevant edge component and test server-drain behavior.
• Allow early data only for operations explicitly safe under replay and rejection.

Сбои и неоднозначные исходы

• UDP blocking, version negotiation, Retry, certificate failure, path validation, and load-balancer misrouting are distinct setup failures.
• QPACK dynamic-table references can block a stream; encoders trade compression efficiency against blocking risk.
• Migration can preserve connection state without preserving bandwidth, latency, or uninterrupted application playback.

Операционный checklist

• Track handshake type, version, ALPN, Retry, 0-RTT acceptance, fallback, and failure class.
• Test packet loss across streams, key updates, NAT rebinding, active migration, server drain, and CID rotation.
• Apply amplification defense, stateless reset protection, congestion control, and address validation.
• Avoid fixed performance percentages or RTT savings without measurements from the target workload.

Связанная концепция

Первичные источники

1. https://www.rfc-editor.org/rfc/rfc9000.html
2. https://www.rfc-editor.org/rfc/rfc9001.html
3. https://www.rfc-editor.org/rfc/rfc9002.html
4. https://www.rfc-editor.org/rfc/rfc9114.html
5. https://www.rfc-editor.org/rfc/rfc9204.html