HTTP/1.1 vs HTTP/2 vs HTTP/3

In one line

Same methods, status codes, and headers; different transport. HTTP/2 multiplexes many requests on one TCP connection; HTTP/3 runs over QUIC on UDP to avoid TCP's head-of-line blocking and speed up connection setup.

0/5 · 0%

Think of it like this

HTTP/1.1 is a single-lane road where each car waits for the one ahead (one request at a time per connection, so browsers open ~6 connections). HTTP/2 is a multi-lane road sharing one entrance: many requests in flight at once on one connection. HTTP/3 builds a new road (QUIC over UDP) where a stalled lane doesn't block the others.

Key ideas

01
HTTP/1.1 (1997): text protocol, keep-alive, one outstanding request per connection in practice. Workarounds like domain sharding and bundling were invented for its limits.
02
HTTP/2 (2015): binary framing, MULTIPLEXED streams on one TCP connection, HPACK header compression, stream priorities. Browsers use it only over HTTPS. gRPC runs on HTTP/2. Weakness: one lost TCP packet stalls ALL streams on that connection (TCP head-of-line blocking; Topic 2.3).
03
HTTP/3 (2022): HTTP over QUIC (Topic 2.4), which runs on UDP with encryption built in. Streams are independent at the transport level, connection setup is faster (fewer round-trips, and 0-RTT resumption), and connections survive network changes (Wi-Fi → mobile) via connection IDs. Servers advertise it with the Alt-Svc header; clients fall back to HTTP/2 if UDP 443 is blocked.
04
In practice: CDNs and load balancers (CloudFront, many ingress controllers) speak HTTP/2 and HTTP/3 to users and often HTTP/1.1 to your backends. Check with curl -sI --http2 / --http3 or the browser's network tab 'Protocol' column.
05
Operational gotchas: gRPC's long-lived HTTP/2 connections defeat L4 load balancing (all requests stick to one backend), so use an L7 proxy or client-side balancing (Topic 5.4). HTTP/3 needs UDP 443 open in firewalls and security groups.

Code & diagrams

which protocol did we get?bash

$ curl -s -o /dev/null -w '%{http_version}\n' --http1.1 https://shop.example.com/
1.1
$ curl -s -o /dev/null -w '%{http_version}\n' --http2 https://shop.example.com/
2
$ curl -sI https://shop.example.com/ | grep -i alt-svc
alt-svc: h3=":443"; ma=86400

Explain it without notes

Why doesn't HTTP/2 fully solve head-of-line blocking?

Practice

Your gRPC service has 5 pods, but one pod gets almost all the traffic. Why, and what are the fixes?

Trade-offs

↔
HTTP/3 improves performance on lossy/mobile networks but adds UDP firewall and observability considerations; terminate it at the edge (CDN/LB) and keep internal hops simpler.

Done when you can

I can check which HTTP version a client negotiated
I know why gRPC needs L7 load balancing