/
draft-ietf-quic-http.txt
3808 lines (2583 loc) · 155 KB
/
draft-ietf-quic-http.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
QUIC M. Bishop, Ed.
Internet-Draft Akamai
Intended status: Standards Track 30 April 2020
Expires: 1 November 2020
Hypertext Transfer Protocol Version 3 (HTTP/3)
draft-ietf-quic-http-latest
Abstract
The QUIC transport protocol has several features that are desirable
in a transport for HTTP, such as stream multiplexing, per-stream flow
control, and low-latency connection establishment. This document
describes a mapping of HTTP semantics over QUIC. This document also
identifies HTTP/2 features that are subsumed by QUIC, and describes
how HTTP/2 extensions can be ported to HTTP/3.
Note to Readers
Discussion of this draft takes place on the QUIC working group
mailing list (quic@ietf.org (mailto:quic@ietf.org)), which is
archived at https://mailarchive.ietf.org/arch/
search/?email_list=quic.
Working Group information can be found at https://github.com/quicwg;
source code and issues list for this draft can be found at
https://github.com/quicwg/base-drafts/labels/-http.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 1 November 2020.
Bishop Expires 1 November 2020 [Page 1]
Internet-Draft HTTP/3 April 2020
Copyright Notice
Copyright (c) 2020 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Simplified BSD License text
as described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 4
1.1. Prior versions of HTTP . . . . . . . . . . . . . . . . . 4
1.2. Delegation to QUIC . . . . . . . . . . . . . . . . . . . 5
2. HTTP/3 Protocol Overview . . . . . . . . . . . . . . . . . . 5
2.1. Document Organization . . . . . . . . . . . . . . . . . . 6
2.2. Conventions and Terminology . . . . . . . . . . . . . . . 7
3. Connection Setup and Management . . . . . . . . . . . . . . . 8
3.1. Draft Version Identification . . . . . . . . . . . . . . 8
3.2. Discovering an HTTP/3 Endpoint . . . . . . . . . . . . . 9
3.2.1. HTTP Alternative Services . . . . . . . . . . . . . . 9
3.2.2. Other Schemes . . . . . . . . . . . . . . . . . . . . 10
3.3. Connection Establishment . . . . . . . . . . . . . . . . 10
3.4. Connection Reuse . . . . . . . . . . . . . . . . . . . . 11
4. HTTP Request Lifecycle . . . . . . . . . . . . . . . . . . . 11
4.1. HTTP Message Exchanges . . . . . . . . . . . . . . . . . 12
4.1.1. Field Formatting and Compression . . . . . . . . . . 14
4.1.2. Request Cancellation and Rejection . . . . . . . . . 17
4.1.3. Malformed Requests and Responses . . . . . . . . . . 18
4.2. The CONNECT Method . . . . . . . . . . . . . . . . . . . 19
4.3. HTTP Upgrade . . . . . . . . . . . . . . . . . . . . . . 20
4.4. Server Push . . . . . . . . . . . . . . . . . . . . . . . 20
5. Connection Closure . . . . . . . . . . . . . . . . . . . . . 22
5.1. Idle Connections . . . . . . . . . . . . . . . . . . . . 22
5.2. Connection Shutdown . . . . . . . . . . . . . . . . . . . 23
5.3. Immediate Application Closure . . . . . . . . . . . . . . 25
5.4. Transport Closure . . . . . . . . . . . . . . . . . . . . 25
6. Stream Mapping and Usage . . . . . . . . . . . . . . . . . . 25
6.1. Bidirectional Streams . . . . . . . . . . . . . . . . . . 26
6.2. Unidirectional Streams . . . . . . . . . . . . . . . . . 26
6.2.1. Control Streams . . . . . . . . . . . . . . . . . . . 27
6.2.2. Push Streams . . . . . . . . . . . . . . . . . . . . 28
6.2.3. Reserved Stream Types . . . . . . . . . . . . . . . . 28
Bishop Expires 1 November 2020 [Page 2]
Internet-Draft HTTP/3 April 2020
7. HTTP Framing Layer . . . . . . . . . . . . . . . . . . . . . 29
7.1. Frame Layout . . . . . . . . . . . . . . . . . . . . . . 30
7.2. Frame Definitions . . . . . . . . . . . . . . . . . . . . 30
7.2.1. DATA . . . . . . . . . . . . . . . . . . . . . . . . 30
7.2.2. HEADERS . . . . . . . . . . . . . . . . . . . . . . . 31
7.2.3. CANCEL_PUSH . . . . . . . . . . . . . . . . . . . . . 31
7.2.4. SETTINGS . . . . . . . . . . . . . . . . . . . . . . 32
7.2.5. PUSH_PROMISE . . . . . . . . . . . . . . . . . . . . 35
7.2.6. GOAWAY . . . . . . . . . . . . . . . . . . . . . . . 36
7.2.7. MAX_PUSH_ID . . . . . . . . . . . . . . . . . . . . . 37
7.2.8. Reserved Frame Types . . . . . . . . . . . . . . . . 38
8. Error Handling . . . . . . . . . . . . . . . . . . . . . . . 38
8.1. HTTP/3 Error Codes . . . . . . . . . . . . . . . . . . . 39
9. Extensions to HTTP/3 . . . . . . . . . . . . . . . . . . . . 40
10. Security Considerations . . . . . . . . . . . . . . . . . . . 41
10.1. Server Authority . . . . . . . . . . . . . . . . . . . . 41
10.2. Cross-Protocol Attacks . . . . . . . . . . . . . . . . . 41
10.3. Intermediary Encapsulation Attacks . . . . . . . . . . . 41
10.4. Cacheability of Pushed Responses . . . . . . . . . . . . 42
10.5. Denial-of-Service Considerations . . . . . . . . . . . . 42
10.5.1. Limits on Field Section Size . . . . . . . . . . . . 43
10.5.2. CONNECT Issues . . . . . . . . . . . . . . . . . . . 44
10.6. Use of Compression . . . . . . . . . . . . . . . . . . . 44
10.7. Padding and Traffic Analysis . . . . . . . . . . . . . . 44
10.8. Frame Parsing . . . . . . . . . . . . . . . . . . . . . 45
10.9. Early Data . . . . . . . . . . . . . . . . . . . . . . . 45
10.10. Migration . . . . . . . . . . . . . . . . . . . . . . . 45
10.11. Privacy Considerations . . . . . . . . . . . . . . . . . 45
11. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 46
11.1. Registration of HTTP/3 Identification String . . . . . . 46
11.2. New Registries . . . . . . . . . . . . . . . . . . . . . 46
11.2.1. Frame Types . . . . . . . . . . . . . . . . . . . . 47
11.2.2. Settings Parameters . . . . . . . . . . . . . . . . 48
11.2.3. Error Codes . . . . . . . . . . . . . . . . . . . . 49
11.2.4. Stream Types . . . . . . . . . . . . . . . . . . . . 52
12. References . . . . . . . . . . . . . . . . . . . . . . . . . 52
12.1. Normative References . . . . . . . . . . . . . . . . . . 52
12.2. Informative References . . . . . . . . . . . . . . . . . 54
Appendix A. Considerations for Transitioning from HTTP/2 . . . . 55
A.1. Streams . . . . . . . . . . . . . . . . . . . . . . . . . 56
A.2. HTTP Frame Types . . . . . . . . . . . . . . . . . . . . 56
A.2.1. Prioritization Differences . . . . . . . . . . . . . 57
A.2.2. Field Compression Differences . . . . . . . . . . . . 57
A.2.3. Guidance for New Frame Type Definitions . . . . . . . 57
A.2.4. Mapping Between HTTP/2 and HTTP/3 Frame Types . . . . 58
A.3. HTTP/2 SETTINGS Parameters . . . . . . . . . . . . . . . 59
A.4. HTTP/2 Error Codes . . . . . . . . . . . . . . . . . . . 60
Appendix B. Change Log . . . . . . . . . . . . . . . . . . . . . 61
Bishop Expires 1 November 2020 [Page 3]
Internet-Draft HTTP/3 April 2020
B.1. Since draft-ietf-quic-http-26 . . . . . . . . . . . . . . 61
B.2. Since draft-ietf-quic-http-25 . . . . . . . . . . . . . . 61
B.3. Since draft-ietf-quic-http-24 . . . . . . . . . . . . . . 61
B.4. Since draft-ietf-quic-http-23 . . . . . . . . . . . . . . 61
B.5. Since draft-ietf-quic-http-22 . . . . . . . . . . . . . . 61
B.6. Since draft-ietf-quic-http-21 . . . . . . . . . . . . . . 62
B.7. Since draft-ietf-quic-http-20 . . . . . . . . . . . . . . 62
B.8. Since draft-ietf-quic-http-19 . . . . . . . . . . . . . . 63
B.9. Since draft-ietf-quic-http-18 . . . . . . . . . . . . . . 63
B.10. Since draft-ietf-quic-http-17 . . . . . . . . . . . . . . 64
B.11. Since draft-ietf-quic-http-16 . . . . . . . . . . . . . . 64
B.12. Since draft-ietf-quic-http-15 . . . . . . . . . . . . . . 65
B.13. Since draft-ietf-quic-http-14 . . . . . . . . . . . . . . 65
B.14. Since draft-ietf-quic-http-13 . . . . . . . . . . . . . . 65
B.15. Since draft-ietf-quic-http-12 . . . . . . . . . . . . . . 65
B.16. Since draft-ietf-quic-http-11 . . . . . . . . . . . . . . 66
B.17. Since draft-ietf-quic-http-10 . . . . . . . . . . . . . . 66
B.18. Since draft-ietf-quic-http-09 . . . . . . . . . . . . . . 66
B.19. Since draft-ietf-quic-http-08 . . . . . . . . . . . . . . 66
B.20. Since draft-ietf-quic-http-07 . . . . . . . . . . . . . . 66
B.21. Since draft-ietf-quic-http-06 . . . . . . . . . . . . . . 66
B.22. Since draft-ietf-quic-http-05 . . . . . . . . . . . . . . 66
B.23. Since draft-ietf-quic-http-04 . . . . . . . . . . . . . . 66
B.24. Since draft-ietf-quic-http-03 . . . . . . . . . . . . . . 67
B.25. Since draft-ietf-quic-http-02 . . . . . . . . . . . . . . 67
B.26. Since draft-ietf-quic-http-01 . . . . . . . . . . . . . . 67
B.27. Since draft-ietf-quic-http-00 . . . . . . . . . . . . . . 68
B.28. Since draft-shade-quic-http2-mapping-00 . . . . . . . . . 68
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 68
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 68
1. Introduction
HTTP semantics [SEMANTICS] are used for a broad range of services on
the Internet. These semantics have most commonly been used with two
different TCP mappings, HTTP/1.1 and HTTP/2. HTTP/3 supports the
same semantics over a new transport protocol, QUIC.
1.1. Prior versions of HTTP
HTTP/1.1 [HTTP11] is a TCP mapping which uses whitespace-delimited
text fields to convey HTTP messages. While these exchanges are
human-readable, using whitespace for message formatting leads to
parsing complexity and motivates tolerance of variant behavior.
Because each connection can transfer only a single HTTP request or
response at a time in each direction, multiple parallel TCP
connections are often used, reducing the ability of the congestion
controller to effectively manage traffic between endpoints.
Bishop Expires 1 November 2020 [Page 4]
Internet-Draft HTTP/3 April 2020
HTTP/2 [HTTP2] introduced a binary framing and multiplexing layer to
improve latency without modifying the transport layer. However,
because the parallel nature of HTTP/2's multiplexing is not visible
to TCP's loss recovery mechanisms, a lost or reordered packet causes
all active transactions to experience a stall regardless of whether
that transaction was directly impacted by the lost packet.
1.2. Delegation to QUIC
The QUIC transport protocol incorporates stream multiplexing and per-
stream flow control, similar to that provided by the HTTP/2 framing
layer. By providing reliability at the stream level and congestion
control across the entire connection, it has the capability to
improve the performance of HTTP compared to a TCP mapping. QUIC also
incorporates TLS 1.3 [TLS13] at the transport layer, offering
comparable security to running TLS over TCP, with the improved
connection setup latency of TCP Fast Open [TFO].
This document defines a mapping of HTTP semantics over the QUIC
transport protocol, drawing heavily on the design of HTTP/2. While
delegating stream lifetime and flow control issues to QUIC, a similar
binary framing is used on each stream. Some HTTP/2 features are
subsumed by QUIC, while other features are implemented atop QUIC.
QUIC is described in [QUIC-TRANSPORT]. For a full description of
HTTP/2, see [HTTP2].
2. HTTP/3 Protocol Overview
HTTP/3 provides a transport for HTTP semantics using the QUIC
transport protocol and an internal framing layer similar to HTTP/2.
Once a client knows that an HTTP/3 server exists at a certain
endpoint, it opens a QUIC connection. QUIC provides protocol
negotiation, stream-based multiplexing, and flow control. Discovery
of an HTTP/3 endpoint is described in Section 3.2.
Within each stream, the basic unit of HTTP/3 communication is a frame
(Section 7.2). Each frame type serves a different purpose. For
example, HEADERS and DATA frames form the basis of HTTP requests and
responses (Section 4.1).
Multiplexing of requests is performed using the QUIC stream
abstraction, described in Section 2 of [QUIC-TRANSPORT]. Each
request-response pair consumes a single QUIC stream. Streams are
independent of each other, so one stream that is blocked or suffers
packet loss does not prevent progress on other streams.
Bishop Expires 1 November 2020 [Page 5]
Internet-Draft HTTP/3 April 2020
Server push is an interaction mode introduced in HTTP/2 [HTTP2] which
permits a server to push a request-response exchange to a client in
anticipation of the client making the indicated request. This trades
off network usage against a potential latency gain. Several HTTP/3
frames are used to manage server push, such as PUSH_PROMISE,
MAX_PUSH_ID, and CANCEL_PUSH.
As in HTTP/2, request and response fields are compressed for
transmission. Because HPACK [HPACK] relies on in-order transmission
of compressed field sections (a guarantee not provided by QUIC),
HTTP/3 replaces HPACK with QPACK [QPACK]. QPACK uses separate
unidirectional streams to modify and track field table state, while
encoded field sections refer to the state of the table without
modifying it.
2.1. Document Organization
The following sections provide a detailed overview of the connection
lifecycle and key concepts:
* Connection Setup and Management (Section 3) covers how an HTTP/3
endpoint is discovered and a connection is established.
* HTTP Request Lifecycle (Section 4) describes how HTTP semantics
are expressed using frames.
* Connection Closure (Section 5) describes how connections are
terminated, either gracefully or abruptly.
The details of the wire protocol and interactions with the transport
are described in subsequent sections:
* Stream Mapping and Usage (Section 6) describes the way QUIC
streams are used.
* HTTP Framing Layer (Section 7) describes the frames used on most
streams.
* Error Handling (Section 8) describes how error conditions are
handled and expressed, either on a particular stream or for the
connection as a whole.
Additional resources are provided in the final sections:
* Extensions to HTTP/3 (Section 9) describes how new capabilities
can be added in future documents.
Bishop Expires 1 November 2020 [Page 6]
Internet-Draft HTTP/3 April 2020
* A more detailed comparison between HTTP/2 and HTTP/3 can be found
in Appendix A.
2.2. Conventions and Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
Field definitions are given in Augmented Backus-Naur Form (ABNF), as
defined in [RFC5234].
This document uses the variable-length integer encoding from
[QUIC-TRANSPORT].
The following terms are used:
abort: An abrupt termination of a connection or stream, possibly due
to an error condition.
client: The endpoint that initiates an HTTP/3 connection. Clients
send HTTP requests and receive HTTP responses.
connection: A transport-layer connection between two endpoints,
using QUIC as the transport protocol.
connection error: An error that affects the entire HTTP/3
connection.
endpoint: Either the client or server of the connection.
frame: The smallest unit of communication on a stream in HTTP/3,
consisting of a header and a variable-length sequence of bytes
structured according to the frame type. Protocol elements called
"frames" exist in both this document and [QUIC-TRANSPORT]. Where
frames from [QUIC-TRANSPORT] are referenced, the frame name will
be prefaced with "QUIC." For example, "QUIC CONNECTION_CLOSE
frames." References without this preface refer to frames defined
in Section 7.2.
peer: An endpoint. When discussing a particular endpoint, "peer"
refers to the endpoint that is remote to the primary subject of
discussion.
receiver: An endpoint that is receiving frames.
Bishop Expires 1 November 2020 [Page 7]
Internet-Draft HTTP/3 April 2020
sender: An endpoint that is transmitting frames.
server: The endpoint that accepts an HTTP/3 connection. Servers
receive HTTP requests and send HTTP responses.
stream: A bidirectional or unidirectional bytestream provided by the
QUIC transport.
stream error: An error on the individual HTTP/3 stream.
The term "payload body" is defined in Section 6.3.3 of [SEMANTICS].
Finally, the terms "gateway", "intermediary", "proxy", and "tunnel"
are defined in Section 2.2 of [SEMANTICS]. Intermediaries act as
both client and server at different times.
3. Connection Setup and Management
3.1. Draft Version Identification
*RFC Editor's Note:* Please remove this section prior to
publication of a final version of this document.
HTTP/3 uses the token "h3" to identify itself in ALPN and Alt-Svc.
Only implementations of the final, published RFC can identify
themselves as "h3". Until such an RFC exists, implementations MUST
NOT identify themselves using this string.
Implementations of draft versions of the protocol MUST add the string
"-" and the corresponding draft number to the identifier. For
example, draft-ietf-quic-http-01 is identified using the string
"h3-01".
Draft versions MUST use the corresponding draft transport version as
their transport. For example, the application protocol defined in
draft-ietf-quic-http-25 uses the transport defined in draft-ietf-
quic-transport-25.
Non-compatible experiments that are based on these draft versions
MUST append the string "-" and an experiment name to the identifier.
For example, an experimental implementation based on draft-ietf-quic-
http-09 which reserves an extra stream for unsolicited transmission
of 1980s pop music might identify itself as "h3-09-rickroll". Note
that any label MUST conform to the "token" syntax defined in
Section 4.4.1.1 of [SEMANTICS]. Experimenters are encouraged to
coordinate their experiments on the quic@ietf.org
(mailto:quic@ietf.org) mailing list.
Bishop Expires 1 November 2020 [Page 8]
Internet-Draft HTTP/3 April 2020
3.2. Discovering an HTTP/3 Endpoint
HTTP relies on the notion of an authoritative response: a response
that has been determined to be the most appropriate response for that
request given the state of the target resource at the time of
response message origination by (or at the direction of) the origin
server identified within the target URI. Locating an authoritative
server for an HTTP URL is discussed in Section 5.4 of [SEMANTICS].
The "https" scheme associates authority with possession of a
certificate that the client considers to be trustworthy for the host
identified by the authority component of the URL. If a server
presents a certificate and proof that it controls the corresponding
private key, then a client will accept a secured connection to that
server as being authoritative for all origins with the "https" scheme
and a host identified in the certificate.
A client MAY attempt access to a resource with an "https" URI by
resolving the host identifier to an IP address, establishing a QUIC
connection to that address on the indicated port, and sending an
HTTP/3 request message targeting the URI to the server over that
secured connection.
Connectivity problems (e.g., blocking UDP) can result in QUIC
connection establishment failure; clients SHOULD attempt to use TCP-
based versions of HTTP in this case.
Servers MAY serve HTTP/3 on any UDP port; an alternative service
advertisement always includes an explicit port, and URLs contain
either an explicit port or a default port associated with the scheme.
3.2.1. HTTP Alternative Services
An HTTP origin advertises the availability of an equivalent HTTP/3
endpoint via the Alt-Svc HTTP response header field or the HTTP/2
ALTSVC frame ([ALTSVC]), using the ALPN token defined in Section 3.3.
For example, an origin could indicate in an HTTP response that HTTP/3
was available on UDP port 50781 at the same hostname by including the
following header field:
Alt-Svc: h3=":50781"
On receipt of an Alt-Svc record indicating HTTP/3 support, a client
MAY attempt to establish a QUIC connection to the indicated host and
port and, if successful, send HTTP requests using the mapping
described in this document.
Bishop Expires 1 November 2020 [Page 9]
Internet-Draft HTTP/3 April 2020
3.2.2. Other Schemes
Although HTTP is independent of the transport protocol, the "http"
scheme associates authority with the ability to receive TCP
connections on the indicated port of whatever host is identified
within the authority component. Because HTTP/3 does not use TCP,
HTTP/3 cannot be used for direct access to the authoritative server
for a resource identified by an "http" URI. However, protocol
extensions such as [ALTSVC] permit the authoritative server to
identify other services which are also authoritative and which might
be reachable over HTTP/3.
Prior to making requests for an origin whose scheme is not "https",
the client MUST ensure the server is willing to serve that scheme.
If the client intends to make requests for an origin whose scheme is
"http", this means that it MUST obtain a valid "http-opportunistic"
response for the origin as described in [RFC8164] prior to making any
such requests. Other schemes might define other mechanisms.
3.3. Connection Establishment
HTTP/3 relies on QUIC version 1 as the underlying transport. The use
of other QUIC transport versions with HTTP/3 MAY be defined by future
specifications.
QUIC version 1 uses TLS version 1.3 or greater as its handshake
protocol. HTTP/3 clients MUST support a mechanism to indicate the
target host to the server during the TLS handshake. If the server is
identified by a DNS name, clients MUST send the Server Name
Indication (SNI) [RFC6066] TLS extension unless an alternative
mechanism to indicate the target host is used.
QUIC connections are established as described in [QUIC-TRANSPORT].
During connection establishment, HTTP/3 support is indicated by
selecting the ALPN token "h3" in the TLS handshake. Support for
other application-layer protocols MAY be offered in the same
handshake.
While connection-level options pertaining to the core QUIC protocol
are set in the initial crypto handshake, HTTP/3-specific settings are
conveyed in the SETTINGS frame. After the QUIC connection is
established, a SETTINGS frame (Section 7.2.4) MUST be sent by each
endpoint as the initial frame of their respective HTTP control
stream; see Section 6.2.1.
Bishop Expires 1 November 2020 [Page 10]
Internet-Draft HTTP/3 April 2020
3.4. Connection Reuse
HTTP/3 connections are persistent across multiple requests. For best
performance, it is expected that clients will not close connections
until it is determined that no further communication with a server is
necessary (for example, when a user navigates away from a particular
web page) or until the server closes the connection.
Once a connection exists to a server endpoint, this connection MAY be
reused for requests with multiple different URI authority components.
In general, a server is considered authoritative for all URIs with
the "https" scheme for which the hostname in the URI is present in
the authenticated certificate provided by the server, either as the
CN field of the certificate subject or as a dNSName in the
subjectAltName field of the certificate; see [RFC6125]. For a host
that is an IP address, the client MUST verify that the address
appears as an iPAddress in the subjectAltName field of the
certificate. If the hostname or address is not present in the
certificate, the client MUST NOT consider the server authoritative
for origins containing that hostname or address. See Section 5.4 of
[SEMANTICS] for more detail on authoritative access.
Clients SHOULD NOT open more than one HTTP/3 connection to a given
host and port pair, where the host is derived from a URI, a selected
alternative service [ALTSVC], or a configured proxy. A client MAY
open multiple connections to the same IP address and UDP port using
different transport or TLS configurations but SHOULD avoid creating
multiple connections with the same configuration.
Servers are encouraged to maintain open connections for as long as
possible but are permitted to terminate idle connections if
necessary. When either endpoint chooses to close the HTTP/3 session,
the terminating endpoint SHOULD first send a GOAWAY frame
(Section 5.2) so that both endpoints can reliably determine whether
previously sent frames have been processed and gracefully complete or
terminate any necessary remaining tasks.
A server that does not wish clients to reuse connections for a
particular origin can indicate that it is not authoritative for a
request by sending a 421 (Misdirected Request) status code in
response to the request; see Section 9.1.2 of [HTTP2].
4. HTTP Request Lifecycle
Bishop Expires 1 November 2020 [Page 11]
Internet-Draft HTTP/3 April 2020
4.1. HTTP Message Exchanges
A client sends an HTTP request on a client-initiated bidirectional
QUIC stream. A client MUST send only a single request on a given
stream. A server sends zero or more interim HTTP responses on the
same stream as the request, followed by a single final HTTP response,
as detailed below.
Pushed responses are sent on a server-initiated unidirectional QUIC
stream; see Section 6.2.2. A server sends zero or more interim HTTP
responses, followed by a single final HTTP response, in the same
manner as a standard response. Push is described in more detail in
Section 4.4.
On a given stream, receipt of multiple requests or receipt of an
additional HTTP response following a final HTTP response MUST be
treated as malformed (Section 4.1.3).
An HTTP message (request or response) consists of:
1. the header field section (see Section 4 of [SEMANTICS]), sent as
a single HEADERS frame (see Section 7.2.2),
2. optionally, the payload body, if present (see Section 6.3.3 of
[SEMANTICS]), sent as a series of DATA frames (see
Section 7.2.1),
3. optionally, the trailer field section, if present (see
Section 4.6 of [SEMANTICS]), sent as a single HEADERS frame.
Receipt of DATA and HEADERS frames in any other sequence MUST be
treated as a connection error of type H3_FRAME_UNEXPECTED
(Section 8).
A server MAY send one or more PUSH_PROMISE frames (see Section 7.2.5)
before, after, or interleaved with the frames of a response message.
These PUSH_PROMISE frames are not part of the response; see
Section 4.4 for more details. These frames are not permitted in
pushed responses; a pushed response which includes PUSH_PROMISE
frames MUST be treated as a connection error of type
H3_FRAME_UNEXPECTED.
Frames of unknown types (Section 9), including reserved frames
(Section 7.2.8) MAY be sent on a request or push stream before,
after, or interleaved with other frames described in this section.
The HEADERS and PUSH_PROMISE frames might reference updates to the
QPACK dynamic table. While these updates are not directly part of
Bishop Expires 1 November 2020 [Page 12]
Internet-Draft HTTP/3 April 2020
the message exchange, they must be received and processed before the
message can be consumed. See Section 4.1.1 for more details.
The "chunked" transfer encoding defined in Section 7.1 of [HTTP11]
MUST NOT be used.
A response MAY consist of multiple messages when and only when one or
more informational responses (1xx; see Section 9.2 of [SEMANTICS])
precede a final response to the same request. Interim responses do
not contain a payload body or trailers.
If an endpoint receives an invalid sequence of frames on either a
request or a push stream, it MUST respond with a connection error of
type H3_FRAME_UNEXPECTED (Section 8). In particular, a DATA frame
before any HEADERS frame, or a HEADERS or DATA frame after the
trailing HEADERS frame is considered invalid.
An HTTP request/response exchange fully consumes a client-initiated
bidirectional QUIC stream. After sending a request, a client MUST
close the stream for sending. Unless using the CONNECT method (see
Section 4.2), clients MUST NOT make stream closure dependent on
receiving a response to their request. After sending a final
response, the server MUST close the stream for sending. At this
point, the QUIC stream is fully closed.
When a stream is closed, this indicates the end of an HTTP message.
Because some messages are large or unbounded, endpoints SHOULD begin
processing partial HTTP messages once enough of the message has been
received to make progress. If a client stream terminates without
enough of the HTTP message to provide a complete response, the server
SHOULD abort its response with the error code H3_REQUEST_INCOMPLETE.
A server can send a complete response prior to the client sending an
entire request if the response does not depend on any portion of the
request that has not been sent and received. When the server does
not need to receive the remainder of the request, it MAY abort
reading the request stream, send a complete response, and cleanly
close the sending part of the stream. The error code H3_NO_ERROR
SHOULD be used when requesting that the client stop sending on the
request stream. Clients MUST NOT discard complete responses as a
result of having their request terminated abruptly, though clients
can always discard responses at their discretion for other reasons.
If the server sends a partial or complete response but does not abort
reading, clients SHOULD continue sending the body of the request and
close the stream normally.
Bishop Expires 1 November 2020 [Page 13]
Internet-Draft HTTP/3 April 2020
4.1.1. Field Formatting and Compression
HTTP messages carry metadata as a series of key-value pairs, called
HTTP fields. For a listing of registered HTTP fields, see the
"Hypertext Transfer Protocol (HTTP) Field Name Registry" maintained
at https://www.iana.org/assignments/http-fields/.
As in previous versions of HTTP, field names are strings containing a
subset of ASCII characters that are compared in a case-insensitive
fashion. Properties of HTTP field names and values are discussed in
more detail in Section 4.3 of [SEMANTICS]. As in HTTP/2, characters
in field names MUST be converted to lowercase prior to their
encoding. A request or response containing uppercase characters in
field names MUST be treated as malformed (Section 4.1.3).
Like HTTP/2, HTTP/3 does not use the Connection header field to
indicate connection-specific fields; in this protocol, connection-
specific metadata is conveyed by other means. An endpoint MUST NOT
generate an HTTP/3 field section containing connection-specific
fields; any message containing connection-specific fields MUST be
treated as malformed (Section 4.1.3).
The only exception to this is the TE header field, which MAY be
present in an HTTP/3 request header; when it is, it MUST NOT contain
any value other than "trailers".
This means that an intermediary transforming an HTTP/1.x message to
HTTP/3 will need to remove any fields nominated by the Connection
field, along with the Connection field itself. Such intermediaries
SHOULD also remove other connection-specific fields, such as Keep-
Alive, Proxy-Connection, Transfer-Encoding, and Upgrade, even if they
are not nominated by the Connection field.
4.1.1.1. Pseudo-Header Fields
Like HTTP/2, HTTP/3 employs a series of pseudo-header fields where
the field name begins with the ':' character (ASCII 0x3a). These
pseudo-header fields convey the target URI, the method of the
request, and the status code for the response.
Pseudo-header fields are not HTTP fields. Endpoints MUST NOT
generate pseudo-header fields other than those defined in this
document, except as negotiated via an extension; see Section 9.
Pseudo-header fields are only valid in the context in which they are
defined. Pseudo-header fields defined for requests MUST NOT appear
in responses; pseudo-header fields defined for responses MUST NOT
appear in requests. Pseudo-header fields MUST NOT appear in
Bishop Expires 1 November 2020 [Page 14]
Internet-Draft HTTP/3 April 2020
trailers. Endpoints MUST treat a request or response that contains
undefined or invalid pseudo-header fields as malformed
(Section 4.1.3).
All pseudo-header fields MUST appear in the header field section
before regular header fields. Any request or response that contains
a pseudo-header field that appears in a header field section after a
regular header field MUST be treated as malformed (Section 4.1.3).
The following pseudo-header fields are defined for requests:
":method": Contains the HTTP method (Section 7 of [SEMANTICS])
":scheme": Contains the scheme portion of the target URI
(Section 3.1 of [RFC3986])
":scheme" is not restricted to "http" and "https" schemed URIs. A
proxy or gateway can translate requests for non-HTTP schemes,
enabling the use of HTTP to interact with non-HTTP services.
":authority": Contains the authority portion of the target URI
(Section 3.2 of [RFC3986]). The authority MUST NOT include the
deprecated "userinfo" subcomponent for "http" or "https" schemed
URIs.
To ensure that the HTTP/1.1 request line can be reproduced
accurately, this pseudo-header field MUST be omitted when
translating from an HTTP/1.1 request that has a request target in
origin or asterisk form; see Section 3.2 of [HTTP11]. Clients
that generate HTTP/3 requests directly SHOULD use the ":authority"
pseudo-header field instead of the Host field. An intermediary
that converts an HTTP/3 request to HTTP/1.1 MUST create a Host
field if one is not present in a request by copying the value of
the ":authority" pseudo-header field.
":path": Contains the path and query parts of the target URI (the
"path-absolute" production and optionally a '?' character followed
by the "query" production; see Sections 3.3 and 3.4 of [URI]. A
request in asterisk form includes the value '*' for the ":path"
pseudo-header field.
This pseudo-header field MUST NOT be empty for "http" or "https"
URIs; "http" or "https" URIs that do not contain a path component
MUST include a value of '/'. The exception to this rule is an
OPTIONS request for an "http" or "https" URI that does not include
a path component; these MUST include a ":path" pseudo-header field
with a value of '*'; see Section 3.2.4 of [HTTP11].
Bishop Expires 1 November 2020 [Page 15]
Internet-Draft HTTP/3 April 2020
All HTTP/3 requests MUST include exactly one value for the ":method",
":scheme", and ":path" pseudo-header fields, unless it is a CONNECT
request; see Section 4.2.
If the ":scheme" pseudo-header field identifies a scheme which has a
mandatory authority component (including "http" and "https"), the
request MUST contain either an ":authority" pseudo-header field or a
"Host" header field. If these fields are present, they MUST NOT be
empty. If both fields are present, they MUST contain the same value.
If the scheme does not have a mandatory authority component and none
is provided in the request target, the request MUST NOT contain the
":authority" pseudo-header and "Host" header fields.
An HTTP request that omits mandatory pseudo-header fields or contains
invalid values for those pseudo-header fields is malformed
(Section 4.1.3).
HTTP/3 does not define a way to carry the version identifier that is
included in the HTTP/1.1 request line.
For responses, a single ":status" pseudo-header field is defined that
carries the HTTP status code; see Section 9 of [SEMANTICS]. This
pseudo-header field MUST be included in all responses; otherwise, the
response is malformed (Section 4.1.3).
HTTP/3 does not define a way to carry the version or reason phrase
that is included in an HTTP/1.1 status line.
4.1.1.2. Field Compression
HTTP/3 uses QPACK field compression as described in [QPACK], a
variation of HPACK which allows the flexibility to avoid compression-
induced head-of-line blocking. See that document for additional
details.
To allow for better compression efficiency, the "Cookie" field
[RFC6265] MAY be split into separate field lines, each with one or
more cookie-pairs, before compression. If a decompressed field
section contains multiple cookie field lines, these MUST be
concatenated into a single octet string using the two-octet delimiter
of 0x3B, 0x20 (the ASCII string "; ") before being passed into a
context other than HTTP/2 or HTTP/3, such as an HTTP/1.1 connection,
or a generic HTTP server application.
Bishop Expires 1 November 2020 [Page 16]
Internet-Draft HTTP/3 April 2020
4.1.1.3. Header Size Constraints
An HTTP/3 implementation MAY impose a limit on the maximum size of
the message header it will accept on an individual HTTP message. A
server that receives a larger header section than it is willing to
handle can send an HTTP 431 (Request Header Fields Too Large) status
code ([RFC6585]). A client can discard responses that it cannot
process. The size of a field list is calculated based on the
uncompressed size of fields, including the length of the name and
value in bytes plus an overhead of 32 bytes for each field.
If an implementation wishes to advise its peer of this limit, it can
be conveyed as a number of bytes in the
SETTINGS_MAX_FIELD_SECTION_SIZE parameter. An implementation which
has received this parameter SHOULD NOT send an HTTP message header
which exceeds the indicated size, as the peer will likely refuse to
process it. However, because this limit is applied at each hop,
messages below this limit are not guaranteed to be accepted.
4.1.2. Request Cancellation and Rejection
Clients can cancel requests by resetting and aborting the request
stream with an error code of H3_REQUEST_CANCELLED (Section 8.1).
When the client aborts reading a response, it indicates that this
response is no longer of interest. Implementations SHOULD cancel
requests by abruptly terminating any directions of a stream that are
still open.
When the server rejects a request without performing any application
processing, it SHOULD abort its response stream with the error code
H3_REQUEST_REJECTED. In this context, "processed" means that some
data from the stream was passed to some higher layer of software that
might have taken some action as a result. The client can treat
requests rejected by the server as though they had never been sent at
all, thereby allowing them to be retried later on a new connection.
Servers MUST NOT use the H3_REQUEST_REJECTED error code for requests
which were partially or fully processed. When a server abandons a
response after partial processing, it SHOULD abort its response
stream with the error code H3_REQUEST_CANCELLED.
When a client resets a request with the error code
H3_REQUEST_CANCELLED, a server MAY abruptly terminate the response
using the error code H3_REQUEST_REJECTED if no processing was
performed. Clients MUST NOT use the H3_REQUEST_REJECTED error code,
except when a server has requested closure of the request stream with
this error code.
Bishop Expires 1 November 2020 [Page 17]
Internet-Draft HTTP/3 April 2020
If a stream is cancelled after receiving a complete response, the
client MAY ignore the cancellation and use the response. However, if
a stream is cancelled after receiving a partial response, the
response SHOULD NOT be used. Automatically retrying such requests is
not possible, unless this is otherwise permitted (e.g., idempotent
actions like GET, PUT, or DELETE).
4.1.3. Malformed Requests and Responses
A malformed request or response is one that is an otherwise valid
sequence of frames but is invalid due to:
* the presence of prohibited fields or pseudo-header fields,
* the absence of mandatory pseudo-header fields,
* invalid values for pseudo-header fields,
* pseudo-header fields after fields,
* an invalid sequence of HTTP messages,
* the inclusion of uppercase field names, or
* the inclusion of invalid characters in field names or values
A request or response that includes a payload body can include a
Content-Length header field. A request or response is also malformed
if the value of a content-length header field does not equal the sum
of the DATA frame payload lengths that form the body. A response
that is defined to have no payload, as described in Section 6.3.3 of
[SEMANTICS] can have a non-zero content-length field, even though no
content is included in DATA frames.
Intermediaries that process HTTP requests or responses (i.e., any
intermediary not acting as a tunnel) MUST NOT forward a malformed
request or response. Malformed requests or responses that are
detected MUST be treated as a stream error (Section 8) of type
H3_GENERAL_PROTOCOL_ERROR.
For malformed requests, a server MAY send an HTTP response prior to
closing or resetting the stream. Clients MUST NOT accept a malformed
response. Note that these requirements are intended to protect
against several types of common attacks against HTTP; they are