HTTP/3 Cover Giacomo Lanzi

HTTP / 3, everything you need to know about the latest version protocol

Estimated reading time: 5 minutes

Security researchers have just digested the HTTP / 2 protocol, but web innovators are already publishing an update: HTTP / 3. This technology offers performance gains and security benefits, but only if we overcome the implementation problems that await us for what appears to be an evolutionary change rather than a real revolution in the way the web works.

In this article I will try to clarify what the new HTTP / 3 protocol is, what its features are and how you can implement them to your web hosting through Cloudflare with the services offered by SOD. < / p>

HTTP/3 fast network

What is HTTP/3 in detail

HTTP / 3 is a major update of the HyperText Transfer Protocol (HTTP), the technology that underlies the transfer of information on the web. HTTP / 3 runs on QUIC, an encrypted general transport protocol that “bundles” multiple data streams on a single connection.

QUIC was initially developed by Google and uses congestion control on User Datagram Protocol (UDP).

What is the relationship with HTTP/2?

HTTP / 2 has brought some improvements through non-blocking download technology, pipelining and server push that help overcome some limitations of the underlying TCP protocol HTTP / 2 as well as HTTP. Basically, with HTTP / 2 we can minimize the number of request – response cycles between client and server .

HTTP / 2 made it possible to send more than one resource on a single TCP connection, a process called multiplexing . The protocol provides greater flexibility in the order of static downloads and pages are no longer constrained by a linear progression of downloads.

It is possible to think of HTTP / 3 as the previous protocol which instead of using TCP for the transfer, uses QUIC, the protocol we mentioned above.

The benefits of the new protocol

The move to QUIC goes a long way towards solving one of the major HTTP/2 problems , namely “head of line blocking”, literally blocking the beginning of the line .

Since the parallel nature of HTTP/2 multiplexing is not visible to TCP’s loss recovery mechanisms, a lost or reordered packet causes all active transactions to stall , regardless of the whether or not a particular transaction was affected by the lost packet.

Since QUIC provides native multiplexing , lost packets only impact the streams in which the data was affected . The practical effect of upgrading to HTTP/3 is to reduce the latency of poor internet connections or frequent packet losses.

Furthermore, QUIC is almost entirely encrypted, which means that security is significantly improved with HTTP/3 . This built-in encryption means fewer opportunities for MitM ( manipulator-in-the-middle ) attacks. QUIC also includes other features that help protect against denial of service (DoS) exploits, which we discussed in another article in relation to ransomware.

QUIC combines its encrypted handshake and transport to allow connection to a new server in a single request . The same technology allows you to quickly resume a broken connection with the client sending encrypted application data in the first interaction. The protocol uses TLS 1.3 as a building block in its encrypted handshake.

Support for the new protocol

As of March 2021, the HTTP/3 protocol is still a standard draft and already has multiple implementations. Currently around 14.3% of the 10 million websites in existence support HTTP/3. For comparison, HTTP/2 is supported by 50.5% of platforms. Data source is W3Techs .

As far as browsers are concerned, the protocol is supported by stable versions of Chrome in a non-default way (from December 2019) and by Firefox (from January 2020).

HTTP/3 Secure connections

The benefits of introducing HTTP/3

HTTP/3 should offer faster load times and better performance for websites, particularly on networks prone to frequent packet loss, than previous technologies.

Achiel van der Mandele, Cloudflare product manager explained: “ In a nutshell, we believe that HTTP/3 will make the internet better for everyone . HTTP/3 is the successor to HTTP/2, which offers better performance when loading websites.

“HTTP/3 users will benefit from faster connection setup and better performance on poor quality networks with high amounts of packet loss. Both of these improvements ensure that websites are load faster and more reliably, “Mandele told The Daily Swig .

Web protocol expert Robin Marx was more cautious about the benefits of HTTP/3:

“Performance should also benefit, albeit not by much in practice,” he said. “Removing the head-of-line block doesn’t matter that much for [things like] loading web pages.

“Most of the gains will come from shorter handshake setup times,” he explained, adding that HTTP/3 and QUIC are “an evolution, not a revolution” .

“Performance will be better, but not in a super noticeable way for things like web browsing,” Marx said. “ Security should be better and protect against different types of attacks “. ( Source )

Availability of the protocol

As we have seen, the new HTTP / 3 transfer protocol could be a notable evolution in security rather than performance, where it will significantly excel in setting handshakes . Not all hosting services are currently able to offer support for the new protocol.

We at SOD offer this through Cloudflare, our partner for CDNs. In our web hosting service it is possible to enable CDN for free and then set up support for the new HTTP / 3 via the Cloudflare panel itself.

For more information, do not hesitate to contact us, we will be happy to answer any questions.

Useful links:

Useful links:

CloudFlare

Install a Let’s Encrypt certificate on Debian based machine

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • SEC Consult SA-20231123 :: Uninstall Key Caching in Fortra Digital Guardian Agent Uninstaller November 27, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27SEC Consult Vulnerability Lab Security Advisory < 20231123-0 > ======================================================================= title: Uninstall Key Caching product: Fortra Digital Guardian Agent Uninstaller (Data Loss Prevention) vulnerable version: Agent:
  • SEC Consult SA-20231122 :: Multiple Vulnerabilities in m-privacy TightGate-Pro November 27, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27SEC Consult Vulnerability Lab Security Advisory < 20231122-0 > ======================================================================= title: Multiple Vulnerabilities product: m-privacy TightGate-Pro vulnerable version: Rolling Release, servers with the following package versions are vulnerable: tightgatevnc < 4.1.2~1 rsbac-policy-tgpro
  • Senec Inverters Home V1, V2, V3 Home & Hybrid Use of Hard-coded Credentials - CVE-2023-39169 November 27, 2023
    Posted by Phos4Me via Fulldisclosure on Nov 27Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
  • [SYSS-2023-019] SmartNode SN200 - Unauthenticated OS Command Injection November 27, 2023
    Posted by Maurizio Ruchay via Fulldisclosure on Nov 27Advisory ID: SYSS-2023-019 Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway Manufacturer: Patton LLC Affected Version(s):
  • CVE-2023-46307 November 27, 2023
    Posted by Kevin on Nov 27running on the remote port specified during setup
  • CVE-2023-46307 November 27, 2023
    Posted by Kevin on Nov 27While conducting a penetration test for a client, they were running an application called etc-browser which is a public GitHub project with a Docker container. While fuzzing the web server spun up with etcd-browser (which can run on any arbitrary port), the application had a Directory Traversal vulnerability that is […]
  • Survey on usage of security advisories November 27, 2023
    Posted by Aurich, Janik on Nov 27Dear list members, we are looking for voluntary participants for our survey, which was developed in the context of a master thesis at the University of Erlangen-Nuremberg. The goal of the survey is to determine potential difficulties that may occur when dealing with security advisories. The focus of the […]
  • [CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389] Multiple vulnerabilities in Loytec products (3) November 27, 2023
    Posted by Chizuru Toyama on Nov 27[+] CVE : CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389 [+] Title : Multiple vulnerabilities in Loytec L-INX Automation Servers [+] Vendor : LOYTEC electronics GmbH [+] Affected Product(s) : LINX-151, Firmware 7.2.4, LINX-212, firmware 6.2.4 [+] Affected Components : L-INX Automation Servers [+] Discovery Date :...
  • [CVE-2023-46383, CVE-2023-46384, CVE-2023-46385] Multiple vulnerabilities in Loytec products (2) November 27, 2023
    Posted by Chizuru Toyama on Nov 27[+] CVE : CVE-2023-46383, CVE-2023-46384, CVE-2023-46385 [+] Title : Multiple vulnerabilities in Loytec LINX Configurator [+] Vendor : LOYTEC electronics GmbH [+] Affected Product(s) : LINX Configurator 7.4.10 [+] Affected Components : LINX Configurator [+] Discovery Date : 01-Sep-2021 [+] Publication date : 03-Nov-2023 [+]...
  • Senec Inverters Home V1, V2, V3 Home & Hybrid Exposure of the Username to an Unauthorized Actor - CVE-2023-39168 November 12, 2023
    Posted by Phos4Me via Fulldisclosure on Nov 12Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/

Customers

Newsletter

{subscription_form_1}