topic
Verified 2026-09-18HTTP/3 and QUIC Controls
HTTP/3 maps HTTP semantics onto QUIC streams and uses its own frame, settings, and error registries.
Negotiate HTTP/3 with TLS and ALPN, enforce stream and connection limits, and treat 0-RTT requests as replayable unless the operation is safe. Do not assume HTTP/2 frame behavior applies unchanged to HTTP/3.
httpprotocolhttp3quicsecurity
Reference (http)
Alt-Svc: h3=":443" QUIC ALPN: h3
Negotiate HTTP/3 with TLS and ALPN, enforce stream and connection limits, and treat 0-RTT requests as replayable unless the operation is safe. Do not assume HTTP/2 frame behavior applies unchanged to HTTP/3.
Common mistakes
- Accepting replay-sensitive early data, forwarding HTTP/3-only controls as HTTP fields, or disabling migration and resource limits without understanding the deployment.