Skip to content

HTTP / TLS protocols#

Problem statement (interviewer prompt)

Explain the differences between HTTP/1.1, HTTP/2 and HTTP/3 (over QUIC), and pick the right one for a mobile-first product on lossy networks. Cover head-of-line blocking, multiplexing, the TLS 1.3 handshake, and where 0-RTT is safe.

Concept illustration 
flowchart LR
  C([Client])
  H1[HTTP 1.1<br/>text, keep-alive]
  H2[HTTP 2<br/>binary, multiplex over TCP]
  H3[HTTP 3 - QUIC<br/>multiplex over UDP]
  T[TLS 1.3<br/>1-RTT or 0-RTT]
  S[Server]
  C --> T --> H1
  C --> T --> H2
  C --> T --> H3
  H1 --> S
  H2 --> S
  H3 --> S

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class C client;
    class H1,H2,H3,T,S service;

Three generations of HTTP solve the same problem at different layers: HTTP/1.1 is text + connection-per-request, HTTP/2 multiplexes streams over one TCP connection, HTTP/3 moves multiplexing to QUIC over UDP to avoid head-of-line blocking.

flowchart TB
  subgraph V1[HTTP 1.1 - 1997]
    direction TB
    A1[Text framing]
    A2[Keep-alive connections]
    A3[Pipelining - rarely used]
    A4[Head-of-line block at app layer]
  end
  subgraph V2[HTTP 2 - 2015]
    direction TB
    B1[Binary framing]
    B2[Multiplexed streams over 1 TCP]
    B3[Header compression - HPACK]
    B4[Server push - deprecated 2022]
    B5[TCP HoL still possible]
  end
  subgraph V3[HTTP 3 - 2022, QUIC]
    direction TB
    C1[UDP transport]
    C2[Multiplexed streams - independent]
    C3[Built-in TLS 1.3]
    C4[0-RTT resumption]
    C5[Connection migration]
  end
  subgraph TLSv[TLS 1.3 - 2018]
    D1[1-RTT handshake]
    D2[0-RTT data replay risk]
    D3[ECDHE + AEAD only]
    D4[mTLS for service-to-service]
  end
  V1 --> V2 --> V3
  TLSv --- V1
  TLSv --- V2
  TLSv --- V3

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class A1,A2,A3,A4,B1,B2,B3,B4,B5,C1,C2,C3,C4,C5,D1,D2,D3,D4 service;

Side-by-side#

HTTP/1.1 HTTP/2 HTTP/3
Transport TCP TCP QUIC over UDP
Framing text lines binary frames binary frames
Multiplex parallel TCP conns streams in one conn streams in one conn
Header compression none HPACK QPACK
Head-of-line block app + TCP TCP only none
Handshake 1-3 RTT (with TLS) 1-3 RTT 1 RTT, often 0-RTT
Server push no yes (now rare) discouraged

When does each matter#

  • Mobile + lossy networks → HTTP/3 wins (QUIC handles packet loss per-stream).
  • High-throughput backends → HTTP/2 is enough; gRPC uses it.
  • Legacy intermediaries / corporate proxies → may still need HTTP/1.1 fallback.
  • Anything internet-facing → terminate at edge with TLS 1.3 + HTTP/3.

TLS 1.3 anatomy#

sequenceDiagram
  participant C as Client
  participant S as Server
  C->>S: ClientHello + key share + ALPN
  S-->>C: ServerHello + key share + cert + finished
  C->>S: finished + application data
  Note over C,S: 1 round-trip total
  • ALPN selects HTTP/1.1 / 2 / 3 inside the TLS handshake.
  • 0-RTT data is replayable - only safe for idempotent requests.
  • mTLS adds a client cert; common for service-to-service inside a zero-trust mesh.

Common interview hooks#

  • "Why is HTTP/2 still vulnerable to head-of-line blocking?" → TCP loss stalls every stream.
  • "When would you keep HTTP/1.1?" → simple proxies, debugging, anything that can't speak h2.
  • "How does QUIC achieve connection migration?" → connection id, not 5-tuple; survives IP change.

Glossary & fundamentals#

Concepts referenced in this design. Each row links to its canonical page; the tag column shows whether it is a high-level (HLD) or low-level (LLD) concept.

Tag Concept What it is Page
HLD HTTP / TLS protocols HTTP 1.1/2/3, QUIC, TLS 1.3 http-protocols
HLD Service mesh sidecar mesh, mTLS, traffic policy service-mesh

Quick reference#

Numbers worth memorising#

  • TLS 1.3 handshake: 1 RTT (0-RTT for resumption).
  • HTTP/2 default max concurrent streams: 100.
  • HPACK dynamic table default: 4 KB.
  • QUIC default idle timeout: 30 s.

Practical advice#

  • Don't terminate TLS in app servers - use a dedicated edge (NGINX, Envoy, ALB).
  • Force HTTPS at edge; HSTS with preload if you control all subdomains.
  • Pre-load certs into HSM/KMS; rotate via ACME (Let's Encrypt).
  • Pin cipher list to TLS 1.3 AEAD only internally.
  • HTTP/2 over plaintext (h2c) is technically allowed but no browser supports it.

Gotchas#

  • Connection: close defeats keep-alive (slow performance).
  • gRPC over HTTP/2 - long-lived streams + RST_STREAM mid-call for cancellation.
  • HTTP/2 server push is effectively dead (Chrome 106 removed support).
  • 0-RTT replay attacks - never use for non-idempotent ops.

Refs#

  • RFC 9110/9112 (HTTP/1.1), RFC 9113 (HTTP/2), RFC 9114 (HTTP/3).
  • RFC 8446 (TLS 1.3).
  • High Performance Browser Networking - Ilya Grigorik (free online).
  • Cloudflare blog on QUIC migration.

FAQ#

What is the difference between HTTP/1.1, HTTP/2 and HTTP/3?#

HTTP/1.1 is text and one request per connection. HTTP/2 is binary multiplexed over one TCP connection. HTTP/3 multiplexes over QUIC on UDP, dodging TCP head-of-line blocking.

Why is HTTP/3 better on mobile networks?#

QUIC streams are independent, so a single lost packet only stalls one stream. It also resumes connections after IP changes, helping cellular handoff and Wi-Fi switches.

How does the TLS 1.3 handshake work?#

Client and server exchange key shares in a single round trip and immediately derive session keys, so encrypted application data flows after just 1 RTT.

When is TLS 1.3 0-RTT safe?#

Only for idempotent requests like GETs. Replay protection is weaker for 0-RTT data, so non-idempotent operations like payments must wait for the full handshake.

What is head-of-line blocking?#

When one packet or request is delayed, all packets behind it in the same connection wait too. HTTP/2 has it at the TCP layer; HTTP/3 over QUIC removes it per stream.

  • API Gateway: API gateways implement HTTP protocol handling, routing, and header manipulation at the edge
  • CDN: CDNs rely on HTTP caching semantics and HTTP/2 multiplexing to optimize content delivery
  • Service Mesh: service meshes use HTTP/2 and gRPC as the primary protocols for service-to-service traffic

Further reading#

Curated, high-credibility sources for going deeper on this topic.

Video walkthrough

HTTP/1 to HTTP/2 to HTTP/3 : via ByteByteGo