HTTP/2

HTTP/2
International standard RFC 7540
Developed by IETF
Introduced May 14, 2015 (2015-05-14)
Superseded by -

HTTP/2 (originally named HTTP/2.0) is a major revision of the HTTP network protocol used by the World Wide Web. It was derived from the earlier experimental SPDY protocol, originally developed by Google.[1] HTTP/2[2] was developed by the Hypertext Transfer Protocol working group httpbis (where bis means "second") of the Internet Engineering Task Force.[3] HTTP/2 is the first new version of HTTP since HTTP 1.1, which was standardized in RFC 2068 in 1997. The Working Group presented HTTP/2 to IESG for consideration as a Proposed Standard in December 2014,[4][5] and IESG approved it to publish as Proposed Standard on February 17, 2015.[6][7] The HTTP/2 specification was published as RFC 7540 in May 2015.[8]

The standardization effort was supported by Chrome, Opera, Firefox,[9] Internet Explorer 11, Safari, Amazon Silk, and Edge browsers.[10] Most major browsers had added HTTP/2 support by the end of 2015.[11]

According to W3Techs, as of October 2018, 30.2% of the top 10 million websites supported HTTP/2.[12]

Goals

The working group charter mentions several goals and issues of concern:[3]

Differences from HTTP 1.1

The proposed changes do not require any changes to how existing web applications work, but new applications can take advantage of new features for increased speed.[13]

HTTP/2 leaves most of HTTP 1.1's high-level syntax, such as methods, status codes, header fields, and URIs, the same. What is new is how the data is framed and transported between the client and the server.[13]

Websites that are efficient minimize the number of requests required to render an entire page by minifying (reducing the amount of code and packing smaller pieces of code into bundles, without reducing its ability to function) resources such as images and scripts. However, minification is not necessarily convenient nor efficient and may still require separate HTTP connections to get the page and the minified resources. HTTP/2 allows the server to "push" content, that is, to respond with data for more queries than the client requested. This allows the server to supply data it knows a web browser will need to render a web page, without waiting for the browser to examine the first response, and without the overhead of an additional request cycle.[14]

Additional performance improvements in the first draft of HTTP/2 (which was a copy of SPDY) come from multiplexing of requests and responses to avoid the head-of-line blocking problem in HTTP 1 (even when HTTP pipelining is used), header compression, and prioritization of requests.[15] HTTP/2 no longer supports HTTP 1.1's chunked transfer encoding mechanism, as it provides its own, more efficient, mechanisms for data streaming.[16]

Genesis in and later differences from SPDY

SPDY (pronounced like "speedy") was a previous HTTP-replacement protocol developed by a research project spearheaded by Google.[17] Primarily focused on reducing latency, SPDY uses the same TCP pipe but different protocols to accomplish this reduction. The basic changes made to HTTP 1.1 to create SPDY included: "true request pipelining without FIFO restrictions, message framing mechanism to simplify client and server development, mandatory compression (including headers), priority scheduling, and even bi-directional communication".[18]

The httpbis working group considered Google's SPDY protocol, Microsoft's HTTP Speed+Mobility proposal (SPDY based),[17] and Network-Friendly HTTP Upgrade.[19] In July 2012 Facebook provided feedback on each of the proposals and recommended HTTP/2 be based on SPDY.[20] The initial draft of HTTP/2 was published in November 2012 and was based on a straight copy of SPDY.[21]

The biggest difference between HTTP/1.1 and SPDY was that each user action in SPDY is given a "stream ID", meaning there is a single TCP channel connecting the user to the server. SPDY split requests into either control or data, using a "simple to parse binary protocol with two types of frames".[18] SPDY showed evident improvement over HTTP, with a new page load speedup ranging from 11.81% to 47.7%.[22]

The development of HTTP/2 used SPDY as a jumping-off point. Among the many detailed differences between the protocols, the most notable is that HTTP/2 uses a fixed Huffman code-based header compression algorithm, instead of SPDY's dynamic stream-based compression. This helps to reduce the potential for compression oracle attacks on the protocol, such as the CRIME attack.

On February 9, 2015, Google announced plans to remove support for SPDY in Chrome in favor of support for HTTP/2.[23] That took effect, starting with Chrome 51.[24][25]

Encryption

HTTP/2 is defined for both HTTP URIs (i.e. without encryption) and for HTTPS URIs (over TLS using ALPN extension[26] where TLS 1.2 or newer is required).[27]

Although the standard itself does not require usage of encryption,[28] all major client implementations (Firefox,[29] Chrome, Safari, Opera, IE, Edge) have stated that they will only support HTTP/2 over TLS, which makes encryption de facto mandatory.[30]

Criticisms

HTTP/2's development process and the protocol itself have faced criticism.

The FreeBSD and Varnish developer Poul-Henning Kamp asserts that the standard was prepared on an unrealistically short schedule, ruling out any basis for the new HTTP/2 other than the SPDY protocol and resulting in other missed opportunities for improvement.[31] Kamp criticizes the protocol itself for being inconsistent and having needless, overwhelming complexity.[31] He also states that the protocol violates the protocol layering principle,[31] for example by duplicating flow control that belongs in the transport layer (TCP). Most concerns, however, have been related to encryption issues.

Encryption

Initially, some members of the Working Group tried to introduce an encryption requirement in the protocol. This faced criticism.

Critics stated that encryption has non-negligible computing costs and that many HTTP applications have actually no need for encryption and their providers have no desire to spend additional resources on it. Encryption proponents have stated that this encryption overhead is negligible in practice.[32] Poul-Henning Kamp has criticised IETF for following a particular political agenda with HTTP/2.[31][33][34] The criticism of the agenda of mandatory encryption within the existing certificate framework is not new, nor is it unique to members of the open-source community – a Cisco employee stated in 2013 that the present certificate model is not compatible with small devices like routers, because the present model requires not only annual enrollment and remission of non-trivial fees for each certificate, but must be continually repeated on an annual basis.[35] Working Group finally did not reach consensus over the mandatory encryption,[28] although most client implementations require it, which makes encryption a de facto requirement.

The HTTP/2 protocol also faced criticism for not supporting opportunistic encryption, a measure against passive monitoring similar to the STARTTLS mechanism that has long been available in other Internet protocols like SMTP. Critics have stated that the HTTP/2 proposal goes in violation of IETF's own RFC7258 "Pervasive Monitoring Is an Attack", which also has a status of Best Current Practice 188.[36] RFC7258/BCP188 mandates that passive monitoring to be considered as an attack, and protocols designed by IETF should take steps to protect against passive monitoring (for example, through the use of opportunistic encryption). A number of specifications for opportunistic encryption of HTTP/2 have been provided,[37][38][39] of which draft-nottingham-http2-encryption was adopted as an official work item of the working group, leading to the publication of RFC 8164 in May 2017.

Development milestones

StatusDateMilestone[3]
DoneDecember 20, 2007[40][41]First HTTP 1.1 Revision Internet Draft
DoneJanuary 23, 2008[42]First HTTP Security Properties Internet Draft
DoneEarly 2012[43]Call for Proposals for HTTP 2.0
DoneOctober 14 – November 25, 2012[44][45]Working Group Last Call for HTTP 1.1 Revision
DoneNovember 28, 2012[46][47]First WG draft of HTTP 2.0, based upon draft-mbelshe-httpbis-spdy-00
Held/EliminatedWorking Group Last Call for HTTP Security Properties
DoneSeptember 2013[48][49]Submit HTTP 1.1 Revision to IESG for consideration as a Proposed Standard
DoneFebruary 12, 2014[50]IESG approved HTTP 1.1 Revision to publish as a Proposed Standard
DoneJune 6, 2014[40][51]Publish HTTP 1.1 Revision as RFC 7230, 7231, 7232, 7233, 7234, 7235
DoneAugust 1, 2014 – September 1, 2014[5][52]Working Group Last call for HTTP/2
DoneDecember 16, 2014[4]Submit HTTP/2 to IESG for consideration as a Proposed Standard
DoneDecember 31, 2014 – January 14, 2015[53]IETF Last Call for HTTP/2
DoneJanuary 22, 2015[54]IESG telechat to review HTTP/2 as Proposed Standard
DoneFebruary 17, 2015[6]IESG approved HTTP/2 to publish as Proposed Standard
DoneMay 14, 2015[55]Publish HTTP/2 as RFC 7540

Server-side support

Server software

  • Apache 2.4.12 supports HTTP/2 via the module mod_h2,[56] although appropriate patches must be applied to the source code of the server in order for it to support that module. As of Apache 2.4.17 all patches are included in the main Apache source tree, although the module itself was renamed mod_http2.[57] Old versions of SPDY were supported via the module mod_spdy,[58] however the development of the mod_spdy module has stopped.[59]
  • Apache Tomcat supports HTTP/2 with version 8.5 and newer with a configuration change.[60]
  • Apache Traffic Server supports HTTP/2.[61]
  • Caddy supports HTTP/2.[62]
  • Citrix NetScaler 11.x supports HTTP/2.[63]
  • Sucuri Supports HTTP/2.[64]
  • F5 BIG-IP Local Traffic Manager 11.6 supports HTTP/2.[65]
  • h2o was built from the ground up for HTTP/2 support.[66]
  • HAProxy 1.8 supports HTTP/2.[67]
  • Jetty 9.3 supports HTTP/2.[68]
  • LiteSpeed Web Server 5.0 supports HTTP/2.[69]
  • Microsoft IIS supports HTTP/2 in Windows 10[70] and Windows Server 2016.
  • Netty 4.1 supports HTTP/2.[71]
  • nginx 1.9.5 supports HTTP/2.[72], released on September 22, 2015, using module ngx_http_v2_module and HTTP/2 Server push since version 1.13.9 in February 20, 2018 [73]
  • Node.js 5.0 supports HTTP/2 with a module[74] and Node 8.4 introduced experimental built-in support for HTTP/2.[75]
  • .NET Core 2.2.0-preview 1 adds support for HTTP/2 [76]
  • OpenLiteSpeed 1.3.11 and 1.4.8 supports HTTP/2.[77]
  • Proxygen supports HTTP/2.
  • Pulse Secure Virtual Traffic Manager 10.2 supports HTTP/2.[78]
  • Radware Alteon NG supports HTTP/2.[79]
  • ShimmerCat supports HTTP/2.[80]
  • Vert.x 3.3 supports HTTP/2.
  • Warp (Haskell web server, used by default in Yesod) supports HTTP/2.
  • Wildfly 9 supports HTTP/2.

Content delivery networks

  • Akamai is the first major CDN to support HTTP/2 and HTTP/2 Server Push. http2.akamai.com showcases Akamai's HTTP/2 implementation, including Server Push.
  • Microsoft Azure supports HTTP/2.
  • CDN77 supports HTTP/2 using nginx (August 20, 2015). http2demo.io is a demonstration of CDN77's HTTP/2 implementation.
  • Cloudflare supports HTTP/2 using nginx with SPDY as a fallback for browsers without support, whilst maintaining all security and performance services.[81] Cloudflare was the first major CDN to support HTTP/2 Server Push.[82]
  • AWS CloudFront supports HTTP/2[83] since September 7, 2016.
  • Fastly supports HTTP/2 including Server Push.[84]
  • Imperva Incapsula CDN supports HTTP/2.[85] http2.incapsula.com showcases Incapsula's HTTP/2 implementation. The implementation includes support for WAF and DDoS mitigation features as well.
  • KeyCDN supports HTTP/2 using nginx (October 6, 2015). HTTP/2 Test is a test page to verify if your server supports HTTP/2.

Not planned

Implementations

See also

References

  1. ↑ Bright, Peter (February 18, 2015). "HTTP/2 finished, coming to browsers within weeks". Ars Technica.
  2. ↑ Thomson, M. (ed.), Belshe M. and R. Peon. "Hypertext Transfer Protocol version 2: draft-ietf-httpbis-http2-16". ietf.org. HTTPbis Working Group. Retrieved February 11, 2015.
  3. 1 2 3 "Hypertext Transfer Protocol Bis (httpbis)". Internet Engineering Task Force. 2012.
  4. 1 2 "History for draft-ietf-httpbis-http2-16". IETF. Retrieved January 3, 2015. 2014-12-16 IESG state changed to Publication Requested
  5. 1 2 Raymor, Brian (August 7, 2014). "Wait for it – HTTP/2 begins Working Group Last Call!". Microsoft Open Technologies. Retrieved 2014-09-07.
  6. 1 2 The IESG (February 17, 2015). "Protocol Action: 'Hypertext Transfer Protocol version 2' to Proposed Standard (draft-ietf-httpbis-http2-17.txt)". httpbis (Mailing list). Retrieved February 18, 2015.
  7. ↑ Mark Nottingham (February 18, 2015). "HTTP/2 Approved". www.ietf.org. Internet Engineering Task Force. Retrieved March 8, 2015.
  8. ↑ "RFC 7540 - Hypertext Transfer Protocol Version 2 (HTTP/2)". IETF. May 2015. Retrieved May 14, 2015.
  9. ↑ "See what's new in Firefox!". www.mozilla.org. Mozilla Foundation. February 2015.
  10. ↑ "Can the rise of SPDY threaten HTTP?". blog.restlet.com. Restlet, Inc. October 2011.
  11. ↑ "HTTP2 browser support". Retrieved March 9, 2017.
  12. ↑ "Usage of HTTP/2 for websites". World Wide Web Technology Surveys. W3Techs. Retrieved October 2, 2018.
  13. 1 2 Ilya Grigorik. "Chapter 12: HTTP 2.0". High Performance Browser Networking. O'Reilly Media, Inc.
  14. ↑ Pratt, Michael. "Apiux". apiux.com. Retrieved March 19, 2014.
  15. ↑ Dio Synodinos (November 2012). "HTTP 2.0 First Draft Published". InfoQ.com. C4Media Inc.
  16. ↑ Belshe, Mike; Thomson, Martin; Peon, Roberto (May 2015). "Hypertext Transfer Protocol Version 2 (HTTP/2)". tools.ietf.org. Retrieved 2017-11-17. HTTP/2 uses DATA frames to carry message payloads. The "chunked" transfer encoding defined in Section 4.1 of [RFC7230] MUST NOT be used in HTTP/2
  17. 1 2 Sebastian Anthony (March 28, 2012). "S&M vs. SPDY: Microsoft and Google battle over the future of HTTP 2.0". ExtremeTech.
  18. 1 2 Grigorik, Ilya. "Life beyond HTTP 1.1: Google's SPDY".
  19. ↑ Willy Tarreau; Amos Jeffries; Adrien de Croy; Poul-Henning Kamp (March 29, 2012). "Proposal for a Network-Friendly HTTP Upgrade". Network Working Group. Internet Engineering Task Force.
  20. ↑ Doug Beaver (July 15, 2012). "HTTP2 Expression of Interest" (mailing list). W3C.
  21. ↑ Dio Synodinos (2012-11-30). "HTTP/2 First Draft Published". InfoQ.
  22. ↑ "SPDY: An experimental protocol for a faster web". The Chromium Projects.
  23. ↑ Chris Bentzel; Bence Béky (2015-02-09). "Hello HTTP/2, Goodbye SPDY". Chromium Blog. Update: To better align with Chrome's release cycle, SPDY and NPN support will be removed with the release of Chrome 51.
  24. ↑ "API Deprecations and Removals in Chrome 51". TL;DR: Support for HTTP/2 is widespread enough that SPDY/3.1 support can be dropped.
  25. ↑ Shadrin, Nick (7 June 2016). "Supporting HTTP/2 for Google Chrome Users | NGINX". NGINX. Retrieved July 10, 2017.
  26. ↑ "RFC 7301 - Transport Layer Security (TLS) Application-Layer Protocol Negotiation Extension". IETF. July 2014.
  27. ↑ Belshe, M.; Peon, R.; Thomson, M. "Hypertext Transfer Protocol Version 2, Use of TLS Features". Retrieved 2015-02-10.
  28. 1 2 "HTTP/2 Frequently Asked Questions". IETF HTTP Working Group. Retrieved September 8, 2014.
  29. ↑ "Networking/http2". MozillaWiki. Retrieved September 7, 2014.
  30. ↑ "mnot's blog: HTTP/2 Implementation Status".
  31. 1 2 3 4 Kamp, Poul-Henning (January 6, 2015). "HTTP/2.0 – The IETF is Phoning It In (Bad protocol, bad politics)". ACM Queue.
  32. ↑ Grigorik, Ilya. "Is TLS Fast Yet?". Retrieved 30 December 2015.
  33. ↑ Kamp, P. H. (2015). "Http/2.0". Communications of the ACM. 58 (3): 40. doi:10.1145/2717515.
  34. ↑ Kamp, Poul-Henning (January 7, 2015). "Re: Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard". ietf-http-wg@w3.org (Mailing list). Retrieved January 12, 2015.
  35. ↑ Lear, Eliot (August 25, 2013). "Mandatory encryption *is* theater". ietf-http-wg@w3.org (Mailing list). Retrieved January 26, 2015.
  36. ↑ Murenin, Constantine A. (January 9, 2015). "Re: Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard". ietf-http-wg@w3.org (Mailing list). Retrieved January 12, 2015.
  37. ↑ Paul Hoffman. "Minimal Unauthenticated Encryption (MUE) for HTTP-2: draft-hoffman-httpbis-minimal-unauth-enc-01". Internet Engineering Task Force.
  38. ↑ Mark Nottingham; Martin Thomson. "Opportunistic Encryption for HTTP URIs: draft-nottingham-http2-encryption-03". Internet Engineering Task Force.
  39. ↑ Mark Nottingham; Martin Thomson. "Opportunistic Security for HTTP: draft-ietf-httpbis-http2-encryption-01". Internet Engineering Task Force.
  40. 1 2 Nottingham, Mark (June 7, 2014). "RFC2616 is Dead". Retrieved September 20, 2014.
  41. ↑ "HTTP/1.1, part 1: URIs, Connections, and Message Parsing: draft-ietf-httpbis-p1-messaging-00". December 20, 2007. Retrieved September 20, 2014.
  42. ↑ "Security Requirements for HTTP: draft-ietf-httpbis-security-properties-00.txt". January 23, 2008. Retrieved September 20, 2014.
  43. ↑ Nottingham, Mark (January 24, 2012). "Rechartering HTTPbis". Retrieved September 20, 2014.
  44. ↑ Nottingham, Mark (October 14, 2012). "Working Group Last Call for HTTP/1.1 p1 and p2". Retrieved September 20, 2014.
  45. ↑ Nottingham, Mark (October 23, 2012). "Second Working Group Last Call for HTTP/1.1 p4 to p7". Retrieved September 20, 2014.
  46. ↑ "SPDY Protocol: draft-ietf-httpbis-http2-00". HTTPbis Working Group. November 28, 2012. Retrieved September 20, 2014.
  47. ↑ Nottingham, Mark (November 30, 2012). "First draft of HTTP/2". Retrieved September 20, 2014.
  48. ↑ "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing". Archived from the original on August 13, 2014. Retrieved September 20, 2014.
  49. ↑ "Last Call: <draft-ietf-httpbis-p1-messaging-24.txt> (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing) to Proposed Standard". The IESG. October 21, 2013. Retrieved September 20, 2014.
  50. ↑ "Protocol Action: 'Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing' to Proposed Standard (draft-ietf-httpbis-p1-messaging-26.txt)". ietf-announce (Mailing list). The IESG. February 12, 2014. Retrieved January 18, 2015.
  51. ↑ The RFC Editor Team (June 6, 2014). "RFC 7230 on Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing". ietf-announce (Mailing list). Retrieved January 18, 2015.
  52. ↑ Nottingham, Mark (August 1, 2014). "Working Group Last Call: draft-ietf-httpbis-http2-14 and draft-ietf-httpbis-header-compression-09". HTTP Working Group. Retrieved September 7, 2014.
  53. ↑ "Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard from The IESG on 2014-12-31". Internet Engineering Task Force. 2014. Retrieved January 1, 2015.
  54. ↑ "IESG Agenda: 2015-01-22". IETF. Archived from the original on January 15, 2015. Retrieved January 15, 2015.
  55. ↑ The RFC Editor Team (May 14, 2015). "RFC 7540 on Hypertext Transfer Protocol Version 2 (HTTP/2)". ietf-announce (Mailing list).
  56. ↑ "http/2 module for apache httpd". Retrieved July 28, 2015.
  57. ↑ "Apache 2.4.17 release changelog". Retrieved August 22, 2017.
  58. ↑ Matthew Steele (June 19, 2014). "mod_spdy is now an Apache project". Google Developers Blog.
  59. ↑ "Log of /httpd/mod_spdy". svn.apache.org. Retrieved February 3, 2017.
  60. ↑ "Apache Tomcat Migration". Retrieved July 29, 2016.
  61. ↑ "Apache Traffic Server Downloads". trafficserver.apache.org. September 21, 2015.
  62. ↑ "caddyserver.com". March 23, 2016.
  63. ↑ "3 Simple Steps to Bring HTTP/2 Performance to Legacy Web Applications". September 22, 2015.
  64. ↑ "Sucuri += HTTP/2 — Announcing HTTP/2 Support". Sucuri. Retrieved December 5, 2015.
  65. ↑ Robert Haynes. "Goodbye SPDY, Hello HTTP/2". F5 Networks. Retrieved September 18, 2015.
  66. ↑ "H2O".
  67. ↑ "What's New in HAProxy 1.8". haproxy.com. Retrieved February 9, 2018.
  68. ↑ "Jetty change log". Eclipse Foundation. May 28, 2015. Retrieved May 28, 2015.
  69. ↑ "LSWS 5.0 Is Out – Support for HTTP/2, ESI, LiteMage Cache". April 17, 2015.
  70. ↑ Rob Trace; David Walp (October 8, 2014). "HTTP/2: The Long-Awaited Sequel". MSDN IEBlog. Microsoft Corporation.
  71. ↑ "Netty.news: Netty 4.1.0.Final released". netty.io. Retrieved June 1, 2016.
  72. ↑ "nginx changelog". www.nginx.com. 2015-09-22.
  73. ↑ http://nginx.org/en/CHANGES-1.14
  74. ↑ "Node http2". www.github.com. July 26, 2016.
  75. ↑ "Node v8.4.0 (Current)". nodejs.org. August 15, 2017.
  76. ↑ "ASP.NET Core 2.2.0-preview1 now available". Retrieved 2018-08-22.
  77. ↑ "OpenLiteSpeed 1.4.5 change log". LiteSpeed Technologies, Inc. February 26, 2015. Retrieved February 26, 2015.
  78. ↑ "Pulse Virtual Traffic Manager". August 22, 2017.
  79. ↑ "Radware Combines an Integrated HTTP/2 Gateway with its Leading Fastview Technology to Provide Web Server Platforms Increased Acceleration". July 20, 2015.
  80. ↑ "www.shimmercat.com". March 23, 2016.
  81. ↑ "HTTP/2 is here! Goodbye SPDY? Not quite yet". CloudFlare. Retrieved December 5, 2015.
  82. ↑ Krasnov, Vlad (April 28, 2016). "Announcing Support for HTTP/2 Server Push". CloudFlare. Retrieved May 18, 2016.
  83. ↑ "Amazon CloudFront now supports HTTP/2". Amazon Web Services, Inc. Retrieved 2016-09-08.
  84. ↑ "Announcing Limited Availability for HTTP/2". Retrieved August 22, 2017.
  85. ↑ "HTTP/2 is here: What You Need to Know". Retrieved November 1, 2015.
  86. ↑ stbuehler. "Feature #2322: Support for SPDY protocol". Lighttpd.
  87. ↑ "Feature #2726: Support for HTTP/2 protocol", Lighttpd
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.