HTTP/2, HTTP/3, QUIC and Modern Web Transport Security — DedSec Project

Study modern HTTP below the application layer: multiplexing, stream state, HPACK/QPACK, QUIC connection IDs, 0-RTT, migration, observability and proxy translation boundaries.

Learning objectives

By the end of this module you should be able to:

• Explain HTTP/2 streams and framing and identify its most important trust boundary, state transition, and evidence source.
• Explain HPACK/QPACK compression state and identify its most important trust boundary, state transition, and evidence source.
• Explain HTTP/3 over QUIC and identify its most important trust boundary, state transition, and evidence source.
• Explain QUIC connection IDs and migration and identify its most important trust boundary, state transition, and evidence source.
• Explain TLS 1.3 integration and identify its most important trust boundary, state transition, and evidence source.
• Explain 0-RTT replay considerations and identify its most important trust boundary, state transition, and evidence source.

Deep concepts

1. HTTP/2 streams and framing

HTTP/2 multiplexes logical streams over one connection using binary frames. Security tooling and reverse proxies must preserve stream boundaries, header semantics, request limits, and error handling so one layer does not validate a different message than the next.

2. HPACK and QPACK

HPACK and QPACK compress header fields using dynamic state. Implementations must bound memory/work, isolate compression context appropriately, and handle malformed or blocked state without allowing resource exhaustion or inconsistent header interpretation.

3. HTTP/3 over QUIC

HTTP/3 maps HTTP semantics onto QUIC streams over UDP. Application authorization should remain protocol-independent, while network monitoring, rate controls, and troubleshooting must account for encrypted transport metadata and different connection behavior.

4. connection IDs and migration

QUIC connection IDs allow a connection to survive path or address changes. Do not use source IP alone as session identity; rate limiting and risk decisions should combine transport state with authenticated application identity and migration-aware telemetry.

5. TLS 1.3 integration

QUIC incorporates TLS 1.3 for authentication and key establishment. Correct certificate/identity validation and application authorization are still separate decisions, and transport encryption does not make untrusted HTTP input safe.

6. 0-RTT replay considerations

Early data can reduce latency but may be replayed under the protocol threat model. Only idempotent or explicitly replay-safe operations should be eligible; sensitive state changes need application controls that remain correct if the same early request is observed more than once.

7. proxy translation boundaries

A request can cross HTTP/3, HTTP/2, and HTTP/1.1 between client, CDN, proxy, and origin. Normalize and validate at each trust boundary and regression-test ambiguous headers, lengths, and routing fields so protocol translation does not create parser differentials.

8. visibility with encrypted transport

QUIC encrypts more transport metadata than traditional TCP/TLS deployments expose to middleboxes. Shift detection toward endpoint, proxy, application, DNS, identity, and flow telemetry instead of assuming full packet visibility is available.

Authorized lab sequence

• Lab 1 — Run a local HTTP service and compare request/response metadata over HTTP/1.1 versus an HTTP/2/3-capable lab stack.

• Lab 2 — Draw stream state for concurrent requests and explain why one transport connection no longer maps neatly to one request at a time.

• Lab 3 — Create a safe replay-sensitivity checklist for operations such as GET-like reads versus state-changing actions.

Knowledge checks

Answer these without looking at the notes:

Next modules

Recommended related modules: 011, 013, 014, 052, 069, 070, 089. From the main menu, choose Search lessons to find related sections across the full guide.