Internet concept

HTTP/3 and QUIC: A new era of speed and security?


8th September 2021

4 min read

What is HTTP/3?

HTTP/3 is the third and upcoming major version of the Hypertext Transfer Protocol (HTTP) used across the web. HTTP has been the main protocol on the internet since the 1990s, with the second release (HTTP/2) introduced in 2015 as a major update with many new features.

Whilst request methods and status codes will remain the same, HTTP/3 makes a departure from its predecessors by not using the Transport Control Protocol (TCP) as the underlying transport layer. Instead, HTTP/3 is implemented with QUIC (pronounced “quick”), a User Datagram Protocol (UDP) based transport layer network protocol originally developed by Google.

HTTP/1 and HTTP/2 were implemented on TCP, therefore using the TCP 3-way-handshake to establish connections. In order to secure these otherwise cleartext connections, Secure Socket Layer (SSL) and Transport Layer Security (TLS) protocols were applied, however many weaknesses have been identified in these cryptographic technologies over the years. This has led to a mass of configuration, security and compatibility concerns as the protocols and associated best practices have evolved.

What is QUIC?

QUIC aims to make network connections faster by reducing the number of round trips between client and server. QUIC achieves this using UDP to establish the connection, resulting in much faster handshakes than a typical TCP connection, especially if the client previously had a connection with the server (0-RTT).QUIC has TLSv1.3 (the latest release) built directly into the protocol, meaning that traffic is always encrypted, simplifying the level of configuration required by administrators.  This reduces the need for yet another handshake whilst adding security and privacy. By design TLSv1.3 protects against downgrade attacks as the protocol requires a key hash of all handshake communications which is then verified by the receiver.

QUIC also advances the streams that were introduced in HTTP/2. Prior to HTTP/2 when a browser connected to a site with multiple files to retrieve, the browser would need to set up a new TCP connection to each. These short-term connections were inefficient and caused bottlenecks, particularly in loading complex pages. HTTP/2 attempted to address this with streams, where one TCP connection was established but multiple streams were used for parallel connections. Unfortunately, this introduced TCP head-of-line blocking, where losing a packet meant that the other streams would need to wait for that packet to be retransmitted. QUIC uses native multiplexing, allowing these streams to now act independently, with lost packets only impacting the streams where data has been dropped. This eliminates the head-of-line blocking inefficiencies found in HTTP/2.

Why HTTP/3?

HTTP/3 introduces a new Connection ID header that is used in place of the IP address and ports seen in previous iterations. This allows for the easy migration of connections between network interfaces e.g., a user switching from Wi-Fi to a mobile data connection. The Connection ID in the user’s browser does not change allowing sessions to migrate easily.

Whilst HTTP/3 makes significant speed and security enhancements, there are several factors which may impact its adoption. Its reliance on UDP is considered problematic as many organisations block or limit UDP traffic, and UDP is considered slow and CPU intensive in its implementation of QUIC. This is believed to be as a result of UDP being under-optimised as it has not received as much attention as TCP over the years. This may be improving according to data produced by Fastly, which showed that QUIC could be as efficient as TLSv1.3 over TCP with fewer acknowledgement packets, coalescing more packets with Generic Segmentation Offload (GSO), and increasing packet size from 1280 bytes to 1460 bytes.

Of course, such significant changes to the fundamental concepts of HTTP offers new attack surfaces, so it comes as no surprise that possible vulnerabilities and attack vectors have already been discussed. What may be comforting is that these vectors are not entirely new, in some cases deriving from existing attacks in HTTP/1 and HTTP/2, and in many cases mitigations and fixes are readily available. These discussed attack vectors include Man-in-the-Middle (MitM), UDP Amplification DoS, stream exhaustion and connection reset attacks.

HTTP/3 Support

Whilst still in its infancy and draft form, HTTP/3 is supported by 73% of running web browsers. It has been supported by Google Chrome and Microsoft Edge (Chromium) since April 2020 and by Mozilla Firefox since May 2021. Safari 14 also includes hidden support in a feature flag that can be enabled. Meanwhile some of the largest websites have already started using HTTP/3 including Google and Facebook. In terms of adoption there is still a long way to go until we see HTTP/3 in all corners of the web, but with growing support it looks like it may be set to stay.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.


  • Insights
  • Labs
ISO 9001 and ISO 27001

Sentrium Achieves ISO 9001 and ISO 27001 Certifications

In an increasingly digital world, the importance of quality and security cannot be overstated. Sentrium Security Ltd is excited to share our recent achievement –…

What are the different types of penetration testing?

What are the different types of penetration testing?

As digital business becomes more widespread, the need to ensure data security increases. One way to test its effectiveness is through penetration testing. Penetration tests…

OWASP Global Image

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

Using a CREST-Approved penetration testing provider

What is CREST penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

cloud computing technology concept transfer database to cloud. T

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…