Card 06/ 10
HTTP/1.1 vs HTTP/2 vs HTTP/3
Same methods, headers and status codes; different framing, connections and transports underneath.
HTTP/1.1, HTTP/2 and HTTP/3 share one meaning, the same methods, headers, status codes and bodies, and differ in how they put those messages on the wire. Code that builds a request and reads a response does not change between them; what changes is the framing, how many requests share a connection, and which transport carries them.
| Property | HTTP/1.1 | HTTP/2 | HTTP/3 |
|---|---|---|---|
| Message format | Text | Binary frames | Binary frames |
| Requests per connection at once | One | Many, as streams | Many, as streams |
| Transport | TCP | TCP | QUIC over UDP |
| Encryption | Optional TLS | TLS in practice; browsers require it | TLS 1.3, always, built into QUIC |
| Setup before the first request | TCP, then TLS: two round trips with TLS 1.3 | The same as HTTP/1.1 | One round trip, or none when resuming |
| A lost packet stalls | That connection's current response | Every stream on the connection | Only the stream it belonged to |
| Header compression | None | HPACK | QPACK |
The one property that does not change is the important one for application code: a GET /orders/42 with an Accept header gets a 200 with a body in every version. A server or proxy can speak HTTP/2 to the browser and HTTP/1.1 to the application behind it without either noticing.
The difference that matters most is where waiting comes from. HTTP/1.1 waits for slow responses, one at a time per connection. HTTP/2 stops that, but inherits TCP's wait on every lost packet. HTTP/3 removes that wait as well, by moving off TCP.
A client discovers which versions a server supports during setup. For HTTP/2, the TLS handshake carries a list of protocols, and the server picks one. For HTTP/3, the server advertises it in an Alt-Svc header on an earlier response, or in a DNS record, and the client tries QUIC next time, falling back if UDP is blocked.
The rule for choosing. Application code chooses none of this; servers, proxies and CDNs do. Enable HTTP/2 wherever TLS is used, and HTTP/3 where the CDN or server supports it, keeping the older versions on for clients and networks that cannot use the newer ones.
← → move through sections and cards