# HTTP/3 and QUIC Security
HTTP/3 is the third major version of the Hypertext Transfer Protocol, built on QUIC (Quick UDP Internet Connections) instead of TCP. QUIC integrates TLS 1.3 directly into the transport layer, providing encrypted connections with reduced latency and improved performance over unreliable networks. HTTP/3 eliminates head-of-line blocking at the transport layer and enables connection migration across network changes without interruption.
HTTP/3 exists to address fundamental performance limitations in HTTP/2 over TCP. While HTTP/2 solved application-layer head-of-line blocking through stream multiplexing, it could not address transport-layer blocking when TCP segments were lost or reordered. A single dropped packet would stall all multiplexed streams until that packet was retransmitted and received. QUIC solves this by implementing stream multiplexing at the transport layer itself, making each stream independent of others for delivery purposes.
The protocol emerged from Google's experimental SPDY and QUIC work, becoming an IETF standard in 2022. Major CDNs including Cloudflare, Fastly, and Amazon CloudFront support HTTP/3, as do browsers like Chrome, Firefox, Safari, and Edge. Adoption is accelerating rapidly because the performance benefits are substantial for mobile users, satellite connections, and any scenario with packet loss or network switching.
From a security perspective, HTTP/3 represents both progress and disruption. The mandatory encryption improves baseline security for web traffic, but the UDP transport and embedded TLS challenge traditional network security architectures built around TCP inspection and termination. Organizations must balance the performance and user experience benefits against the operational complexity of securing and monitoring QUIC traffic.
QUIC operates over UDP port 443, implementing reliability, congestion control, flow control, and security features that TCP and TLS traditionally provided separately. The protocol stack integration enables significant optimizations impossible with layered approaches.
Connection Establishment and 0-RTT
QUIC's connection handshake combines transport and cryptographic establishment. Initial connections require one round-trip: the client sends a ClientHello with QUIC transport parameters, and the server responds with transport and TLS parameters plus the initial data. Subsequent connections from the same client can use 0-RTT resumption, where the client immediately sends application data along with the connection request, using cached parameters from previous sessions.
For example, a returning user visiting an e-commerce site with 0-RTT enabled can send their initial page request in the same packet as the connection establishment. The server can immediately process the request and respond with page content, eliminating the round-trip delay that TCP plus TLS would require. This provides substantial performance improvements, particularly over high-latency networks.
Stream Independence and Multiplexing
QUIC implements streams as first-class transport objects. Each HTTP request/response pair uses a separate QUIC stream, and packet loss affecting one stream does not block others. If packets containing data for stream 4 are lost, streams 8, 12, and 16 continue processing normally while only stream 4 waits for retransmission.
This differs fundamentally from HTTP/2 over TCP, where a single lost TCP segment blocks all multiplexed streams at the transport layer. Even though HTTP/2 can process other streams at the application layer, the TCP receive window cannot advance until the missing segment arrives, creating artificial delays across all concurrent requests.
Connection Migration
QUIC connections are identified by connection IDs rather than the traditional 4-tuple of source IP, destination IP, source port, and destination port. When a mobile device switches from Wi-Fi to cellular, or when a load balancer changes the source IP, the QUIC connection continues seamlessly. The client includes the same connection ID in packets from the new network path, and the server recognizes the existing connection state.
Connection migration happens transparently to applications. A video stream or file download that started on Wi-Fi continues uninterrupted when the user leaves the building and switches to cellular. Traditional TCP connections would break and require re-establishment, often causing application timeouts or restart delays.
Header Compression with QPACK
HTTP/3 replaces HTTP/2's HPACK header compression with QPACK, designed specifically for QUIC's multi-stream environment. HPACK maintained a single compression context shared across all streams, creating head-of-line blocking when the context update for one stream was delayed.
QPACK uses separate encoder and decoder streams for compression state, allowing each request/response stream to reference the compression table without blocking on updates. Dynamic table updates flow through dedicated streams, while HTTP headers can be compressed using either static references or dynamic table entries that have been acknowledged as received.
Congestion Control and Flow Control
QUIC implements congestion control algorithms similar to TCP but adapted for multiple streams. The protocol controls sending rates at both the connection level and individual stream level. Stream-level flow control prevents a fast sender from overwhelming receivers on a per-request basis, while connection-level control manages overall bandwidth usage.
Loss detection uses packet numbers that strictly increase, unlike TCP sequence numbers that can wrap. This enables more precise loss detection and faster recovery. QUIC can distinguish between packet loss due to congestion versus corruption or reordering, adapting its response accordingly.
HTTP/3 adoption fundamentally changes web traffic patterns and network security assumptions. The shift from TCP to UDP breaks inspection capabilities that organizations have relied on for over two decades, while the mandatory encryption eliminates plaintext visibility that legacy security tools expected.
Network Security Tool Disruption
Traditional deep packet inspection (DPI) systems, intrusion detection systems, and network firewalls cannot inspect QUIC payload content without TLS termination. These tools, designed around TCP flow reconstruction and cleartext or known-encrypted protocols, face an encrypted UDP stream with application data mixed into the transport layer handshake.
Organizations using network-based data loss prevention must either deploy new QUIC-aware tools or terminate TLS connections at inspection points. Both approaches require significant investment and operational changes. Some organizations choose to block QUIC entirely, forcing fallback to HTTP/2, but this approach becomes less viable as QUIC adoption grows among critical business applications.
Firewall and Network Policy Challenges
UDP-based transport bypasses TCP state tracking that many firewalls use for connection validation. Traditional firewall rules allowing inbound TCP 443 do not cover QUIC traffic on UDP 443. Network administrators must update policies to allow UDP 443 while implementing appropriate rate limiting and flood protection for UDP traffic.
The connection migration feature complicates IP-based access controls. A session that begins from one IP address can continue from another, potentially bypassing location-based restrictions or logging systems that track connections by source IP. Organizations with strict network segmentation or geographic access controls must account for QUIC's migration capabilities.
Performance Versus Security Trade-offs
0-RTT resumption creates a window for replay attacks. An attacker who captures 0-RTT data can replay it to the server, potentially causing duplicate transactions or unintended operations. While TLS 1.3 includes replay protections, applications processing 0-RTT data must be idempotent or implement additional replay protection.
Organizations must evaluate which endpoints should accept 0-RTT data. Payment processing, account modifications, and other sensitive operations typically should not accept 0-RTT requests, while static content delivery and read-only operations can safely use 0-RTT for performance benefits.
Operational Monitoring Gaps
Network operations teams lose detailed visibility into connection establishment, error rates, and performance metrics when QUIC traffic is encrypted end-to-end. Troubleshooting application issues becomes more difficult without visibility into transport-layer behavior, requiring investment in application-layer monitoring and QUIC-aware network tools.
CDA approaches HTTP/3 and QUIC security through the lens of attack surface reduction and continuous monitoring capability preservation. The protocol spans multiple domains: VSD for vulnerability assessment of QUIC implementations, DPS for data protection in encrypted transport, and TID for threat identification in encrypted traffic streams.
The DPS domain owns the primary security concerns around QUIC deployment. QUIC's mandatory encryption aligns with CDA's defense-in-depth principles, but the loss of network-layer visibility requires careful planning. During C-HARDEN missions, CDA operators evaluate whether organizations can maintain adequate security monitoring after QUIC adoption. This often reveals over-dependence on network-layer inspection that should have been supplemented with application-layer controls years earlier.
CDA's Continuous Surface Reduction methodology applies directly to QUIC security decisions. Every QUIC service enabled represents a surface that must be secured and monitored. The critical question is not whether QUIC is secure, but whether the organization can detect and respond to threats against QUIC-based services as effectively as TCP-based services.
Where conventional security thinking focuses on blocking or controlling QUIC, CDA emphasizes adaptation and measurement. Blocking QUIC may provide short-term visibility preservation but creates long-term performance and compatibility problems. Instead, CDA helps organizations invest in QUIC-compatible security tools and application-layer monitoring that provides equivalent or better threat detection capabilities.
The VSD domain evaluates QUIC implementation risks, particularly around 0-RTT handling and connection state management. QUIC implementations are newer and less battle-tested than TCP stacks, creating potential for implementation vulnerabilities. CDA vulnerability assessments specifically test QUIC parsing, connection migration handling, and 0-RTT replay protection.
CDA differs from conventional approaches by treating QUIC adoption as inevitable rather than optional. The performance benefits are too significant for organizations to ignore long-term, and major platforms are already defaulting to QUIC where available. CDA helps organizations prepare for a QUIC-dominant future rather than fighting a rearguard action against adoption.
The TID domain focuses on threat detection in QUIC environments, emphasizing metadata analysis over payload inspection. Connection patterns, timing analysis, certificate monitoring, and behavioral analytics become more important when payload content is encrypted. CDA threat identification methodology adapts to work with encrypted transport while maintaining detection effectiveness.
• QUIC's mandatory encryption improves baseline security but eliminates network-layer payload inspection, requiring organizations to invest in new monitoring approaches and QUIC-aware security tools.
• Connection migration and 0-RTT features provide significant performance benefits but challenge traditional IP-based access controls and create replay attack risks that must be mitigated at the application layer.
• Blocking QUIC provides short-term visibility preservation but becomes operationally unsustainable as adoption grows across critical business applications and major platforms.
• Organizations should update firewall policies for UDP 443, evaluate 0-RTT risks for sensitive endpoints, and prioritize application-layer monitoring over transport-layer inspection for long-term security effectiveness.
• CDA's approach emphasizes adapting security controls to work with QUIC rather than blocking adoption, focusing on attack surface reduction and continuous monitoring capability preservation.