HTTP/2

HTTP/2 (originally named HTTP/2.0) is the second major version of the HTTP network protocol used by the World Wide Web. It is based on the SPDY protocol, originally developed by Google. HTTP/2 was developed by the Hypertext Transfer Protocol working group (httpbis, where bis means “second”) of the Internet Engineering Task Force. HTTP/2 is the first new version of HTTP since HTTP 1.1, which was standardized in RFC 2068 in 1997. The Working Group presented HTTP/2 to IESG for consideration as a Proposed Standard in December 2014, and IESG approved it to publish as Proposed Standard on February 17, 2015. The HTTP/2 specification was published as RFC 7540 in May 2015.

The standardization effort was supported by Chrome, Opera, Firefox, Internet Explorer 11, Safari, Amazon Silk and Edge browsers. Most major browsers added HTTP/2 support by the end of 2015.

According to W3Techs, as of April 2016, 7.1% of the top 10 million websites supported HTTP/2. According to research by isthewebhttp2yet.com, as of May 2016, CloudFlare provision HTTP/2 across more domains than any other network provider.

Goals

The working group charter mentions several goals and issues of concern:

• Negotiation mechanism that allows clients and servers to elect to use HTTP 1.1, 2.0, or potentially other non-HTTP protocols.
• Maintain high-level compatibility with HTTP 1.1 (for example with methods, status codes, and URIs, and most header fields)
• Decrease latency to improve page load speed in web browsers by considering:
  • Data compression of HTTP headers
  • HTTP/2 Server Push.
  • Pipelining of requests
  • Fixing the head-of-line blocking problem in HTTP 1.x
  • Multiplexing multiple requests over a single TCP connection
• Support common existing use cases of HTTP, such as desktop web browsers, mobile web browsers, web APIs, web servers at various scales, proxy servers, reverse proxy servers, firewalls, and content delivery networks

Differences from HTTP 1.1

The proposed changes do not require any changes to how existing web applications work, but new applications can take advantage of new features for increased speed.

HTTP/2 leaves most of HTTP 1.1's high-level syntax, such as methods, status codes, header fields, and URIs, the same. The element that is modified is how the data is framed and transported between the client and the server.

Websites that are efficient minimize the number of requests required to render an entire page by minifying (reducing the amount of code and packing smaller pieces of code into bundles, without reducing its ability to function) resources such as images and scripts. However, minification is not necessarily convenient nor efficient and may still require separate HTTP connections to get the page and the minified resources. HTTP/2 allows the server to "push" content, that is, to respond with data for more queries than the client requested. This allows the server to supply data it knows a web browser will need to render a web page, without waiting for the browser to examine the first response, and without the overhead of an additional request cycle.

Additional performance improvements in the first draft of HTTP/2 (which was a copy of SPDY) come from multiplexing of requests and responses to avoid the head-of-line blocking problem in HTTP 1 (even when HTTP pipelining is used), header compression, and prioritization of requests.

Genesis in and later differences from SPDY

SPDY (pronounced like "speedy") was a previous HTTP-replacement protocol developed by a research project spearheaded by Google. SPDY primarily focused on reducing latency. SPDY uses the same TCP pipe but different protocols to accomplish this reduction. The basic changes made to HTTP 1.1 to create SPDY included: "true request pipelining without FIFO restrictions, message framing mechanism to simplify client and server development, mandatory compression (including headers), priority scheduling, and even bi-directional communication".

The httpbis working group considered Google's SPDY protocol, Microsoft's HTTP Speed+Mobility proposal (SPDY based), and Network-Friendly HTTP Upgrade. In July 2012 Facebook provided feedback on each of the proposals and recommended HTTP/2 be based on SPDY. The initial draft of HTTP/2 was published in November 2012 and was based on a straight copy of SPDY.

The biggest difference between HTTP/1.1 and SPDY was that each user action in SPDY is given a "stream ID", meaning there is a single TCP channel connecting the user to the server. SPDY split requests into either control or data, using a "simple to parse binary protocol with two types of frames." SPDY showed evident improvement from HTTP, with a new page load speedup ranging from 11.81% to 47.7%.

The development of HTTP/2 used SPDY as a jumping-off point. Among the many detailed differences between the protocols, the most notable is that HTTP/2 uses a fixed Huffman code-based header compression algorithm, instead of SPDY's dynamic stream-based compression. This helps to reduce the potential for compression oracle attacks on the protocol, such as the CRIME attack.

On February 9, 2015, Google announced plans to remove support for SPDY in Chrome by early 2016, in favor of support for HTTP/2, starting with Chrome 40.

Encryption

HTTP/2 is defined for both HTTP URIs (i.e. without encryption) and for HTTPS URIs (over TLS, where TLS 1.2 or newer is required).

Although the standard itself does not require usage of encryption, most client implementations (Firefox, Chrome, Safari, Opera, IE, Edge) have stated that they will only support HTTP/2 over TLS, which makes encryption de facto mandatory.

Criticisms

HTTP/2's development process and the protocol itself have faced criticism.

The FreeBSD and Varnish developer Poul-Henning Kamp claims that the standard was prepared on an unrealistically short schedule, ruling out any basis for the new HTTP/2 other than the SPDY protocol and resulted in missing other opportunities for improvements. Kamp criticizes the protocol itself for being inconsistent and having needless, overwhelming complexity. He also states that the protocol violates the protocol layering principle, for example by duplicating flow control that belongs in the transport layer (TCP). Most concerns, however, have been related to encryption issues.

Encryption

Initially, some members of the Working Group were trying to push an encryption requirement into the protocol. This faced criticism.

Critics stated that encryption has non-negligible computing costs and that many HTTP applications have actually no need for encryption and their providers have no desire to spend additional resources on it. Encryption proponents have stated that this encryption overhead is negligible in practice. Poul-Henning Kamp has criticised IETF for following a particular political agenda with HTTP/2. The criticism of the agenda of mandatory encryption within the existing certificate framework is not new, nor is it unique to members of the open-source community – a Cisco employee stated in 2013 that the present certificate model is not compatible with small devices like routers, because the present model requires not only annual enrollment and remission of non-trivial fees for each certificate, but must be continually repeated on an annual basis. Working Group finally did not reach consensus over the mandatory encryption, although most client implementations require it, which makes encryption a de facto requirement.

The HTTP/2 protocol also faced criticism for not supporting opportunistic encryption, a measure against passive monitoring similar to the STARTTLS mechanism that has long been available in other internet protocols like SMTP. Critics have stated that the HTTP/2 proposal goes in violation of IETF's own RFC7258 "Pervasive Monitoring Is an Attack", which also has a status of Best Current Practice 188. RFC7258/BCP188 mandates that passive monitoring to be considered as an attack, and protocols designed by IETF should take steps to protect against passive monitoring (for example, through the use of opportunistic encryption). A number of specifications for opportunistic encryption of HTTP/2 have been provided, of which draft-ietf-httpbis-http2-encryption-01 is an official work item of the working group.

Development milestones

Status	Date	Milestone
Done	December 20, 2007	First HTTP 1.1 Revision Internet Draft
Done	January 23, 2008	First HTTP Security Properties Internet Draft
Done	Early 2012	Call for Proposals for HTTP 2.0
Done	October 14 – November 25, 2012	Working Group Last Call for HTTP 1.1 Revision
Done	November 28, 2012	First WG draft of HTTP 2.0, based upon draft-mbelshe-httpbis-spdy-00
Held/Eliminated		Working Group Last Call for HTTP Security Properties
Done	September 2013	Submit HTTP 1.1 Revision to IESG for consideration as a Proposed Standard
Done	February 12, 2014	IESG approved HTTP 1.1 Revision to publish as a Proposed Standard
Done	June 6, 2014	Publish HTTP 1.1 Revision as RFC 7230, 7231, 7232, 7233, 7234, 7235
Done	August 1, 2014 – September 1, 2014	Working Group Last call for HTTP/2
Done	December 16, 2014	Submit HTTP/2 to IESG for consideration as a Proposed Standard
Done	December 31, 2014 – January 14, 2015	IETF Last Call for HTTP/2
Done	January 22, 2015	IESG telechat to review HTTP/2 as Proposed Standard
Done	February 17, 2015	IESG approved HTTP/2 to publish as Proposed Standard
Done	May 14, 2015	Publish HTTP/2 as RFC 7540

Software and services supporting HTTP/2

Main article: Comparison of web server software

Server software

• Apache 2.4.12 supports HTTP/2 via the module mod_h2, although appropriate patches must be applied to the source code of the server in order for it to support that module. As of Apache 2.4.17 all patches are included in the main Apache source tree, although the module itself was renamed mod_http2. Old versions of SPDY were supported via the module mod_spdy, however the development of the module has stopped.
• Apache Traffic Server supports HTTP/2.
• Caddy supports HTTP/2.
• Citrix NetScaler 11.x supports HTTP/2.
• Sucuri Supports HTTP/2.
• F5 BIG-IP Local Traffic Manager 11.6 supports HTTP/2.
• h2o was built from the ground up for HTTP/2 support.
• Jetty 9.3 supports HTTP/2.
• LiteSpeed Web Server 5.0 supports HTTP/2.
• Microsoft IIS supports HTTP/2 in Windows 10 and Windows Server 2016.
• nginx 1.9.5 supports HTTP/2.
• OpenLiteSpeed 1.3.11 and 1.4.8 supports HTTP/2.
• Proxygen supports HTTP/2.
• Radware Alteon NG supports HTTP/2.
• ShimmerCat was built from the ground up for HTTP/2 support.
• Warp (Haskell web server, used by default in Yesod) supports HTTP/2.
• Wildfly 9 supports HTTP/2.

Content delivery networks

• Akamai Edge Servers supports HTTP/2. http2.akamai.com showcases Akamai's HTTP/2 implementation.
• CDN77 supports HTTP/2 using nginx (August 20, 2015). http2demo.io is a demonstration of CDN77's HTTP/2 implementation.
• CloudFlare supports HTTP/2 using nginx with SPDY as a fallback for browsers without support, whilst maintaining all security and performance services. CloudFlare are the first major CDN to support HTTP/2 Server Push.
• Imperva Incapsula CDN supports HTTP/2. http2.incapsula.com showcases Incapsula's HTTP/2 implementation. The implementation includes support for WAF and DDoS mitigation features as well.
• KeyCDN supports HTTP/2 using nginx (October 6, 2015). HTTP/2 Test is a test page to verify if your server supports HTTP/2.

Not planned

• lighttpd has no support for SPDY or HTTP/2 planned in version 1.x.

Implementations

• Other implementations are collected on the GitHub HTTP/2 wiki.

See also

• HTTP pipelining
• QUIC
• SPDY
• WebSocket
• Comparison of web browsers#Protocol support

External links

• Official website
• RFC 7540 – Hypertext Transfer Protocol version 2 (HTTP/2)
• RFC 7541 – HPACK: Header Compression for HTTP/2
• SPDY Protocol (draft-mbelshe-httpbis-spdy-00)
• HTTP Speed+Mobility (draft-montenegro-httpbis-speed-mobility-01)
• Proposal for a Network-Friendly HTTP Upgrade (draft-tarreau-httpbis-network-friendly-00)