HTTP/3 & QUIC

Published on:

Most important commands to remember

  • curl --version — check for HTTP/3 support in this binary.
  • curl --http3-only — attempt HTTP/3 without falling back to an older version.

Commands and flags

Option or syntax Meaning
--http3-only Require HTTP/3 for this request rather than silently succeeding over HTTP/2 or HTTP/1.1.
-sS -o /dev/null Keep errors, hide progress, and discard the body.
-w 'HTTP %{http_version}\n' Print the actual protocol version and a newline.
--max-time 10 Bound the transfer to ten seconds.

The quoted format belongs to curl. The public endpoint’s current support and your network path are observations to check, not assumptions.

The concepts that matter

1. HTTP/3 uses QUIC instead of TCP

HTTP/3 maps HTTP requests and responses onto QUIC, a transport built over UDP. Methods, status codes, and resource semantics remain HTTP; the transport and framing change.

Using UDP underneath does not make HTTP/3 unreliable. QUIC implements the reliability, ordering within streams, flow control, and congestion control needed above UDP. A firewall that permits TCP HTTPS but blocks the corresponding UDP path can prevent HTTP/3.

2. Independent streams reduce transport coupling

QUIC delivers ordered data within each stream without requiring missing data from one stream to block delivery on all other streams. This addresses TCP’s connection-wide ordered-stream coupling seen with HTTP/2.

It does not eliminate shared congestion, bandwidth limits, or every application dependency. HTTP/3 header compression uses QPACK, whose dependencies also require coordination. One stream can still be slow even while others progress.

3. TLS is integrated into the transport handshake

QUIC uses TLS 1.3 for authentication and key establishment. Certificate identity and trust remain important; choosing HTTP/3 does not remove hostname verification.

Some resumed connections can send early data, reducing startup latency. Early data has replay considerations, so not every operation is appropriate for it. Faster establishment is a capability under suitable conditions, not a promise that every request finishes sooner.

4. Connection identity can survive some address changes

QUIC connection IDs let an established connection be identified separately from a fixed IP-address-and-port tuple. This supports controlled migration, for example when a client changes networks, subject to protocol and deployment constraints.

Path validation and peer policy still apply. A connection ID does not guarantee seamless migration across every firewall or load balancer. Operational tooling must also understand that a UDP flow and a QUIC connection are related but not identical objects.

One small example

Optional: run these commands with your installed curl. The second makes a public HTTPS request and deliberately forbids older-version fallback.

curl --version
curl --http3-only -sS -o /dev/null -w 'HTTP %{http_version}\n' --max-time 10 https://curl.se/

Look for HTTP3 in the feature list. If the option is unsupported, the local binary cannot run this experiment. That is different from an endpoint or network refusing QUIC.

A reported version 3 after a successful transfer confirms HTTP/3 for this request. A timeout or negotiation failure does not alone distinguish missing server support, UDP filtering, or other reachability problems. Do not treat a failed transfer’s version field as proof of success.

The body is discarded and certificate checking remains enabled. No connection migration or concurrent-stream behavior is demonstrated by this single transfer, and no cleanup is needed.

Keep this idea: HTTP/3 keeps HTTP semantics while QUIC supplies secure, reliable streams over UDP; verify the actual negotiated transport.