HTTP/3 and QUIC Explained: What Changes for Your Web App

HTTP/3 finally went mainstream in 2024, and most CDNs now enable it by default. Here is what your team should know.

QUIC is the real story

HTTP/3 is “HTTP over QUIC”. QUIC is a UDP-based transport designed by Google and standardized as RFC 9000. It bundles TLS 1.3 directly into the transport layer.

Layer	HTTP/2	HTTP/3
Application	HTTP	HTTP
Security	TLS 1.2/1.3	TLS 1.3 (built into QUIC)
Transport	TCP	QUIC over UDP

The wins

• 0-RTT resumption — repeat connections skip the handshake entirely.
• No head-of-line blocking — packet loss on stream A no longer stalls stream B.
• Connection migration — your phone switching from Wi-Fi to LTE keeps the same connection.

The catches

• Some corporate firewalls drop UDP/443 traffic. HTTP/3 falls back to HTTP/2 — measure it.
• Server CPU usage is slightly higher because the TCP work moves into userspace.
• Debugging requires qlog/qvis instead of tcpdump — invest in tooling early.

How to enable it

Cloudflare, Fastly, AWS CloudFront and Akamai all support HTTP/3 with a single toggle. For self-hosted nginx, add listen 443 quic reuseport; and the corresponding Alt-Svc header.

TL;DR

If you serve a global audience on mobile, HTTP/3 is a free latency win. Test fallbacks, then turn it on.