HTTP/3 · XB Field Notes

HTTP3 rides UDP while HTTP2 stays safe over TCP

Sat, 12 Feb 2028 00:00:00 +0000

HTTP/3 runs over QUIC and UDP, commonly on port 443. HTTP/2 streams on a TCP connection share an ordered byte stream, so a missing segment can stall delivery for unrelated requests. QUIC provides ordered delivery per stream: losing data on one stream need not block delivery on another. Connection-wide congestion control and HTTP dependencies can still affect several streams; this is not independent congestion control for every stream.

Enabling a server module alone is insufficient. The client needs HTTP/3 support, an authoritative endpoint, acceptable TLS credentials, and a working UDP path. Discovery and fallback policies determine when that path is attempted.

Two transports, one port number

UDP:443 and TCP:443 use separate sockets with the same numeric port. An nginx server block can therefore combine listen 443 quic reuseport; with listen 443 ssl; http2 on;. The reuseport option permits per-worker listening sockets on supported systems; it is not a blanket remedy for duplicate server declarations or unrelated processes occupying the port. Check the actual configuration error and socket ownership before changing options.

QUIC integrates TLS 1.3 with transport establishment and can reduce setup round trips. Resumption may permit early application data, but does not eliminate the handshake or guarantee acceptance of 0-RTT. Retry, loss, and validation can add delay. Connection IDs support continuity across address changes when the endpoints and routing infrastructure support it.

Alt-Svc is how the client finds out

An origin can advertise Alt-Svc: h3=":443"; ma=86400 over an existing HTTP connection. This names protocol h3, the same host on port 443, and a 24-hour freshness lifetime. It does not require that connection to use HTTP/2, and prior knowledge can allow a direct HTTP/3 attempt. Clients may use a fresh alternative without waiting for a later page visit; an advertisement alone does not prove reachability.

Freshness permits reuse of the advertisement; it does not force a client to repeat a failed QUIC attempt on every connection. Clients can fall back or apply failure policies. QUIC probe timers depend on RTT estimates and backoff, while the decision to race or abandon a connection belongs to the implementation. The earlier 15-second, 300-seconds-per-day and 0.1-second figures were illustrative assumptions without a retained runnable model or trace, not measured or required fallback timings.

0-RTT and migration are the two sharp edges

0-RTT lets a returning client send application data before completing the new handshake. Early data has replay risk, so the application must define replay-safe handling and reject unsafe early operations. A previous ticket does not guarantee acceptance. An unprotected create-order request can duplicate a side effect; transport encryption alone does not provide exactly-once execution.

Migration can preserve a QUIC connection after a client address changes, subject to peer policy and path validation. A five-tuple balancer can instead send packets to a backend lacking that connection’s cryptographic state, causing interruption or reset. The earlier backend 7-to-4 example has no retained hash model or trace and is not a measured placement result.

When it breaks

A cached advertisement and blocked UDP can delay connection establishment, but neither a day-long penalty nor an HTTP/3 failure proves a middlebox fault. Missing client support, TLS errors, endpoint configuration, and server availability can produce failures too. Compare client errors and protocol-specific latency with server observations; absence from an access log alone is inconclusive. Keep a working TCP alternative and measure the actual client’s fallback policy.

Address changes can also expose incorrect routing affinity. Preserve routing to the QUIC endpoint that owns the connection state; an application cookie alone cannot route encrypted packets before QUIC termination. Validate the deployed connection-ID handling and path changes explicitly. These failures are not limited to mobile clients, and application-session continuity is a separate concern after transport succeeds.

Direct h3 discovery is possible; h2 fallback depends on both endpoints and client policy. No fixed fallback timing or successful migration is guaranteed.

Check it quickly

Use Bash, Python 3 and curl 7.88+ built with HTTP/2 and HTTP/3. Set URL to one authorized direct HTTPS GET endpoint returning 200, including its path. Choose a repeatable read-only resource. No redirects or proxies are used:

(
set -euo pipefail
: "${URL:?Set one authorized HTTPS URL with an expected 200 response}"
umask 077
tmp=$(mktemp -d)
trap 'rm -rf -- "$tmp"' EXIT
probe() {
 local label=$1 mode=$2 expected=$3 rc check_rc
 if curl --disable --silent --show-error --fail --globoff \
 --noproxy '*' --proto '=https' --connect-timeout 10 --max-time 30 \
 "$mode" --output /dev/null --dump-header "$tmp/$label.headers" \
 --write-out '%{json}\n' --url "$URL" > "$tmp/$label.json"; then
 rc=0
 else
 rc=$?
 printf '%s: curl failed (exit %s)\n' "$label" "$rc" >&2
 fi
 if python3 - "$tmp/$label.json" "$label" "$expected" "$URL" "$rc" <<'PY'
import json, math, pathlib, sys
path, label, expected, url, curl_exit = sys.argv[1:]
print(label, "curl_exit", curl_exit)
d, headers = None, None
try:
 d = json.loads(pathlib.Path(path).read_text())
 if not isinstance(d, dict):
 raise ValueError("expected a JSON object")
except (OSError, UnicodeError, ValueError) as error:
 d = None
 print(label, "metadata unavailable:", str(error), file=sys.stderr)
keys = ("url_effective", "remote_ip", "remote_port", "http_version", "http_code",
 "ssl_verify_result", "time_appconnect", "time_starttransfer", "time_total")
if d is not None:
 print(label, json.dumps({k: d[k] for k in keys + ("exitcode", "errormsg") if k in d}))
 missing = [k for k in keys if k not in d]
 if missing:
 print(label, "metadata fields unavailable:", ", ".join(missing), file=sys.stderr)
try:
 headers = pathlib.Path(path).with_suffix(".headers").read_text(encoding="iso-8859-1")
 print(label, "Alt-Svc header observations:",
 [line for line in headers.splitlines() if line.lower().startswith("alt-svc:")])
except OSError as error:
 print(label, "header observations unavailable:", str(error), file=sys.stderr)
if int(curl_exit) != 0:
 # Observations from a failed transfer are not successful validation.
 raise SystemExit(0)
try:
 ok = (d is not None and headers is not None and d["http_code"] == 200 and
 d["url_effective"] == url and d["http_version"] in ("1.1", "2", "3") and
 d["remote_ip"] and d["remote_port"] > 0 and d["ssl_verify_result"] == 0 and
 (expected == "any" or d["http_version"] == expected) and
 all(math.isfinite(d[k]) and d[k] >= 0 for k in
 ("time_appconnect", "time_starttransfer", "time_total")))
except (KeyError, TypeError, ValueError):
 ok = False
if not ok:
 raise SystemExit(label + ": unavailable or unexpected endpoint, protocol, status or timing")
PY
 then
 check_rc=0
 else
 check_rc=$?
 fi
 if [ "$rc" -ne 0 ]; then
 return "$rc"
 fi
 return "$check_rc"
}
failed=0
probe h2 --http2 2 || failed=1
probe h3-only --http3-only 3 || failed=1
probe fallback-enabled --http3 any || failed=1
exit "$failed"
)

Each successful probe checks status, URL and protocol. Failed transfers retain available observations, original exit and stderr; missing or malformed metadata is labeled unavailable. Later probes still run. –http3-only forbids fallback; –http3 permits racing older protocols. A result of 2 or 1.1 records TCP selection, not a controlled blocked-UDP experiment; 1.1 does not prove h2. time_appconnect ends at handshake completion; time_starttransfer ends at first byte. Alt-Svc observations may include interim responses and do not establish reachability.

On the corresponding authorized server, inspect configuration and local sockets separately:

(
set -euo pipefail
umask 077
tmp=$(mktemp -d)
trap 'rm -rf -- "$tmp"' EXIT
if nginx -T > "$tmp/nginx.txt" 2> "$tmp/nginx.err"; then
 cat "$tmp/nginx.err" >&2
else
 rc=$?
 cat "$tmp/nginx.err" >&2
 exit "$rc"
fi
if grep -nE 'listen .*quic|http2|http3|Alt-Svc' "$tmp/nginx.txt"; then
 :
else
 rc=$?
 printf 'No matching directives, or grep failed (exit %s)\n' "$rc" >&2
 exit "$rc"
fi
ss -H -lunp 'sport = :443' > "$tmp/udp.txt"
cat "$tmp/udp.txt"
if [ ! -s "$tmp/udp.txt" ]; then
 printf 'No local UDP:443 listener observed\n' >&2
 exit 1
fi
)

Diagnostics stay visible. Configuration matches may include comments or inactive settings; socket owners may be hidden by permissions. Neither identifies the running public endpoint without further correlation. Treat configuration output as potentially sensitive. Only shell syntax and fake/file controls ran here; actual TLS, HTTP, NGINX and fallback validation remain held.

Sources

RFC 9114 HTTP/3, HTTP/3 semantics over QUIC, checked 2026-09-16.
RFC 7838 HTTP Alternative Services, the Alt-Svc header and its freshness lifetime, checked 2026-09-16.
ngx_http_v3_module, the nginx QUIC and HTTP/3 directives, checked 2026-09-16.
RFC 9000 QUIC, per-stream delivery, connection IDs, migration, and 0-RTT, checked 2026-09-16.
nginx core listen directive, separate listeners and per-worker reuseport semantics, checked 2026-10-18.
curl manual, HTTP/3-only mode, fallback choice, errors, and handshake timing, checked 2026-10-18.
RFC 9002 QUIC recovery, RTT-dependent probe timers and exponential backoff, checked 2026-10-18.

HTTP/3 separates stream delivery, not all recovery

Sun, 21 Mar 2027 00:00:00 +0000

HTTP/3 carries HTTP over QUIC instead of TCP. QUIC offers independently ordered streams, so a missing range in one stream need not prevent delivery of already received data on another. This removes a particular transport ordering dependency. It does not give each request a separate congestion controller, loss detector, or guaranteed completion time.

QUIC removes a cross-stream delivery-order dependency: complete B can be exposed while A awaits a missing byte. It does not isolate all recovery, bandwidth, flow credit or application dependencies, and this model makes no timing claim.

Delivery ordering is not loss detection

HTTP/2 frames share TCP’s single ordered byte stream. A missing range blocks delivery of later bytes to HTTP, even when those bytes belong to another response. Previously delivered data remains available; a loss does not retroactively stop every application action. The affected requests depend on where their bytes fall relative to the gap.

QUIC maintains offsets within each stream. Received data on stream B can become available while stream A awaits a missing prefix. However, a QUIC packet can contain frames from several streams, so losing one packet can affect several streams together. Necessary information is sent again in new packets; packet identity and stream offsets serve different purposes.

RFC 9002 separates loss detection by packet-number space, not by HTTP request or stream. RTT estimation and congestion control describe the network path. Stream-level flow control coexists with connection-level credit. A shared capacity or credit shortage can therefore delay multiple streams despite independent ordering.

Keep HTTP semantics and deployment boundaries

Methods, status codes, and representation semantics remain HTTP semantics. HTTP/3 changes their framing and uses QPACK for field compression. QUIC integrates TLS 1.3 authentication and packet protection. Scheduling and priority policies still decide which available stream data to send. A field section that depends on unavailable QPACK dynamic-table entries can still block. Removing TCP ordering does not remove every protocol or application dependency, including shared database locks and server queues.

Lossy paths can benefit, but measure the actual workload rather than promising a universal speedup. CPU costs, handshake success, scheduling, bandwidth, and client implementation all affect results. Compare negotiated protocols and response completion on the same measured hop; an edge using HTTP/3 says nothing about its upstream protocol.

Clients can discover HTTP/3 through mechanisms such as Alt-Svc. When UDP connectivity prevents QUIC establishment, RFC 9114 recommends trying TCP-based HTTP. That is not a guarantee of immediate HTTP/2 fallback: client behavior and available server protocols matter. Operators still need reachable alternatives, appropriate advertisements, and measurements of failed attempts and fallback delay.

When it breaks

A firewall or middlebox can block QUIC traffic or interfere with usable datagram sizes. A successful advertisement is not evidence that a client established QUIC. Keep failures visible by network and protocol, and test fallback deliberately before relying on it for availability.

TLS resumption can permit 0-RTT application data before handshake completion. It is not simply replaying a ClientHello as an optimization, and accepted early requests can be replayed. Under RFC 8470, clients without additional information must not send unsafe methods in early data; idempotency alone is insufficient. A 425 response requires retrying outside early data, rather than treating an uncertain purchase as a fresh action.

Connection IDs can support migration after an address change, but successful continuation is conditional on protocol rules, configuration, routing, and path validation. NAT rebinding and deliberate migration are related but distinct cases. A load balancer that loses connection affinity can still break traffic. Migration is not permission to trust an arbitrary address or bypass validation.

Check it quickly

Save this as quic_streams.py and run python3 quic_streams.py with Python 3. It opens no sockets. The model compares delivery through one ordered transport with delivery ordered separately within two streams. Abstract chunks carry explicitly positioned bytes; there is no claim that these chunks reproduce packet framing or an actual recovery algorithm.

# Each tuple is a stream name, a one-byte offset, and that byte.
# Chunks are abstract delivery units, not QUIC packets or TCP segments.
def available(chunks, received, separate_streams):
 buffered = {"A": {}, "B": {}}
 for number, chunk in enumerate(chunks):
 if number not in received:
 if not separate_streams:
 break # One ordered transport cannot expose later chunks.
 continue
 for stream, offset, byte in chunk:
 assert len(byte) == 1
 buffered[stream][offset] = byte
 result = {}
 for stream, offsets in buffered.items():
 body = b""
 while len(body) in offsets:
 body += offsets[len(body)]
 result[stream] = body
 return result


chunks = [[("A", 0, b"a")], [("A", 1, b"b")],
 [("B", 0, b"x")], [("B", 1, b"y")]]
received = {0, 2, 3} # The unit carrying A's second byte is missing.
independent = available(chunks, received, True)
ordered = available(chunks, received, False)
assert independent == {"A": b"a", "B": b"xy"}
assert ordered == {"A": b"a", "B": b""}
print("one missing A byte:", independent, ordered)

complete = {"A": b"ab", "B": b"xy"}
for separate in (False, True):
 assert available(chunks, set(range(4)), separate) == complete
print("after repair: both models expose", complete)

# A single missing delivery unit can contain bytes for both streams.
shared = [[("A", 0, b"a")], [("A", 1, b"b"), ("B", 0, b"x")],
 [("B", 1, b"y")]]
assert available(shared, {0, 2}, True) == {"A": b"a", "B": b""}
assert available(shared, {0, 1, 2}, True) == complete
# Even an independently ordered stream cannot skip its own missing prefix.
assert available(chunks, {0, 1, 3}, True) == {"A": b"ab", "B": b""}
print("negative controls: shared loss affects both; stream-local gaps still block")
print("delivery-order model only; no loss detector, timer, congestion, or wire test")

With the second A byte missing, independent ordering exposes A’s first byte and all of B, while the shared ordered transport exposes only A’s first byte. Supplying the missing chunk makes both results complete. No elapsed-time numbers are invented.

The negative controls matter: losing a chunk containing A and B data blocks both streams’ missing prefixes, and receiving B’s second byte alone cannot skip its first. This demonstrates only the stated ordering assumptions. It does not measure retransmission timing, congestion, flow-control exhaustion, QPACK, TLS, migration, or browser performance. Those require an actual implementation and separately authorized network experiments.

Sources

RFC 9000: QUIC, sections 2, 4, 8–9, 12–13: ordering, flow control, migration, packets, and retransmitted information, checked 2026-10-15.
RFC 9002: QUIC recovery, section 6: packet-number-space loss detection and path-wide congestion behavior, checked 2026-10-15.
RFC 9114: HTTP/3, HTTP mapping, discovery, and TCP fallback guidance, checked 2026-10-15.
RFC 9204: QPACK, section 2.1.2: blocked field sections, checked 2026-10-15.
RFC 9001: TLS with QUIC, section 9.2: 0-RTT replay considerations, checked 2026-10-15.
RFC 8470: HTTP early data, sections 4–5: method safety and 425 retry behavior, checked 2026-10-15.
Cloudflare: HTTP/3 and QUIC, introductory protocol background, not proof of this model, checked 2026-10-15.

HTTP/3 · XB Field Notes

HTTP3 rides UDP while HTTP2 stays safe over TCP

Two transports, one port number

Alt-Svc is how the client finds out

0-RTT and migration are the two sharp edges

When it breaks

Check it quickly

Sources

HTTP/3 separates stream delivery, not all recovery

Delivery ordering is not loss detection

Keep HTTP semantics and deployment boundaries

When it breaks

Check it quickly

Further reading

Sources