HTTP/2 vs HTTP/3: What Actually Changes For Your App, And What Doesn't

The Practical Developer

The Libuv Thread Pool Trap: Why Node.js Async APIs Stall Under Load Postgres Covering Indexes with INCLUDE: Eliminate Heap Fetches on Read-Heavy Workloads Postgres DISTINCT ON: The Fastest Way to Get the Latest Row Per Group Postgres Transaction Isolation: The Anomalies Your App Actually Faces in Production Linux TCP Tuning for Node.js Microservices: The Kernel Settings That Stop Silent Connection Drops Under Load Postgres HOT Updates and Fillfactor: Why Not All Writes Are Created Equal Database Connection Pool Leaks: Finding the Promise That Never Returns Its Seat Linux OOM Killer in Production: Why Your Node.js Containers Die Without a Stack Trace Postgres Materialized Views: Refresh Strategies That Do Not Lock Your Dashboards API Dependency Health Checks: Why /health Is Not Enough Authorization with Zanzibar Tuples: How Google Manages Permissions and How To Build the Same Check in Node.js Postgres Advisory Locks: The 20-Character Primitive That Replaces Redis for Coordination Dead Letter Queues: The Message Queue Pattern That Saves You at 2 a.m. File Descriptor Exhaustion: The Kernel Limit That Silently Drops Node.js Connections Graceful Degradation: The Pattern That Turns Total Outages into Partial Success PostgreSQL Full-Text Search: Dropping Elasticsearch for 90% of Use Cases S3 Presigned Multipart Uploads: Stop Your API Server from Being a File Upload Bottleneck MessagePack vs JSON: The Binary Serialization Switch That Cut Our Internal RPC Overhead by 40% DNS Caching in Node.js: The Silent Cause of Production Latency Spikes Reliable Cron Jobs: The Pattern That Stops Double Runs, Missed Executions, And The 2 AM Page GraphQL Query Complexity: Stop the OOM Query Before It Reaches Your Resolver Node.js Event Loop Lag: The Hidden Metric Behind Random Latency Spikes API Request Validation with Zod: The Schema That Catches Bad Input Before It Corrupts Your Database Load Shedding in Node.js: How to Reject Traffic Before You Drown Request Hedging: Cut Tail Latency In Half Without Overprovisioning Git Bisect: The Automated Binary Search That Finds Breaking Commits in Minutes Node.js Garbage Collection Tuning: Stop Letting V8 Pause Your Event Loop Node.js Server Timeouts: The Settings That Stop Slow Clients from Holding Sockets Hostage Postgres BRIN Indexes: The Time-Series Secret That Shrinks Indexes by 99% Event Sourcing with PostgreSQL: The Pragmatic 80% Solution Node.js Cluster Mode: Scaling the Event Loop Across CPU Cores Postgres Partial Indexes: Stopping Soft Deletes from Ruining Your Query Performance Request Coalescing with the Singleflight Pattern: Stop Drowning Your Database on Every Cache Miss The Bulkhead Pattern: Why One Slow Endpoint Should Not Drown Your Whole Service Node.js AsyncLocalStorage: End-to-End Request Context Without the Propagation Hell Postgres Deadlocks: Logging the Victim, Reproducing the Race, and Fixing the Lock Order Your Node.js HTTP Client Is the Bottleneck: Connection Pool Tuning That Works Optimistic Locking in Postgres: Stop Losing Data to Race Conditions Postgres Read Replicas: Stop Serving Stale Data to Your Users Cursor Pagination: Why Offset Queries Explode at Scale and How to Fix Them Node.js Worker Threads: 60 Lines That Stop a CSV Upload from Timing Out Every Other Request Reliable Webhook Delivery: Architecture for Outbound HTTP You Can Trust Request Timeouts and Deadline Propagation: Stop the Chain of Slowness Advanced Security Practices in Node.js Graceful Shutdown in Node.js: The 40 Lines That Stop 502s During Deploys Finding Node.js Memory Leaks with Heap Snapshots Idempotency Keys in 30 Lines: Stop Your Webhook From Charging Customers Twice Backpressure In Node.js: The Fix For Slow-Motion Queue Meltdowns Retries Done Right: Jitter, Budgets, and the Stampede You Did Not See Coming The Cache Stampede: Why Your "Just Add Redis" Layer Crashes Postgres at 3 a.m. Postgres SKIP LOCKED: An 80-Line Job Queue You Can Run Without Redis Stop Doing Work Nobody Wants: AbortController in Node.js, Done Right The N+1 Query Problem: We Found 23 In One Codebase And Killed Every One I Tried 5 AI Coding Tools for a Month. Here Is What I Actually Use CI/CD From Zero to Production in 30 Minutes With GitHub Actions Node.js vs Bun vs Deno: Which Runtime Should You Pick in 2025? Kubernetes Resource Requests And Limits: The Numbers That Decide If Your Cluster Is Stable The Three Pillars of Observability Are A Myth: What Actually Matters In Production pnpm Vs npm Vs yarn Vs Bun For Monorepos: Which One Earns The Migration In 2024 JSONB Indexing In Postgres: GIN Vs Expression Indexes, And When Each Is The Right Choice A Code Review Checklist That Ends The Same Three Arguments Every Sprint gRPC Vs REST In 2024: When The Switch Pays For Itself React Suspense For Data Fetching: The Pattern That Replaces Half Your Loading State Code The Five-Stage Rollout: How To Ship A Risky Change Without Holding Your Breath GitHub Actions In A Monorepo: Caching, Path Filters, And Secret Boundaries That Actually Work The Blameless Postmortem That Actually Improves Things: A Template And Six Hard-Won Rules Recursive CTEs In Postgres: How To Query A Tree Without N Round Trips Node.js Streams: When They Actually Help, And When They Just Add Complexity Playwright Vs Cypress In 2024: The Honest Comparison Of Which One Earns The Test Time React Server Components: The Mental Model That Makes The "use client" Boundary Obvious Pod Disruption Budgets: The K8s Object That Keeps Your Service Up During Cluster Maintenance Postgres LISTEN/NOTIFY: The Pub/Sub You Already Have And Are Not Using Chaos Engineering Starter Kit: The Five Drills That Don't Need Netflix-Scale Spec-Driven API Development With OpenAPI: How To Stop Drifting From Your Docs Saga Pattern vs Two-Phase Commit: Distributed Transactions Without The Lies Kubernetes Autoscaling Beyond CPU: The Custom-Metric HPA Pattern That Actually Works Postgres Partitioning For Time-Series: The Boring Setup That Saves Your Database Distributed Locks With Redis: An Honest Look At Redlock And When You Don't Need It Image Optimization For The Web In 2023: srcset, AVIF, And The Lighthouse Score You Actually Want Kafka vs RabbitMQ: A Decision Tree That Doesn't Hate You UUID vs Bigint Primary Keys In Postgres: The Index Math That Decides For You Flame Graphs: How To Find The Slow Function In 30 Seconds Without Profiling Theatre Postgres Streaming Vs. Logical Replication: Which One Solves Your Actual Problem ESLint Rules That Earn Their Keep: The Twelve I Enable On Every Project Pre-Commit Hooks That Pay For Themselves: Husky, lint-staged, And The Five Rules That Stick Zero-Downtime Database Migrations: The Six-Step Pattern That Rules Them All Circuit Breakers In Node.js: 50 Lines That Stop A Failing Dependency From Taking Down Your Service Postgres VACUUM Is Not Magic: How Your Hot Table Bloats To 80GB And How To Fix It Kubernetes Liveness And Readiness Probes: The Difference That Causes Half Your Outages Rate Limiting In Production: A Token Bucket In 30 Lines Of Redis The Outbox Pattern: How To Stop Losing Events When Postgres And Kafka Disagree Load Testing With k6: The Three Scenarios That Find Real Bugs (Not Synthetic Numbers) Postgres Row-Level Security For Multi-Tenant Apps: The Pattern That Stops You From Leaking Data Rebase vs. Merge: The Team Policy That Ends The Argument Forever OpenTelemetry in Node.js: Distributed Tracing That Actually Helps During an Incident Feature Flags That Pay Rent: The 4 Flag Types And When To Delete Each ETag, Last-Modified, and the Caching Headers Most APIs Get Wrong Connection Pooling Without the Cargo Cult: pgbouncer in 100 Lines of Config JSONB Is Not a Schema: When To Reach For It in Postgres, And When To Stop Bash Strict Mode: The Three Lines That Stop Your Deploy Script From Lying To You

The Practica · 2023-08-04 · via The Practical Developer

A team is migrating their CDN to support HTTP/3 because somebody said it is faster. After a week of work, the Lighthouse score is unchanged, the p99 latency is unchanged, and the engineer who pushed for the change cannot point to a single user-visible win. The migration was real work and produced no benefit, because for that workload (a desktop web app on cable internet) the differences between HTTP/2 and HTTP/3 are essentially invisible.

HTTP/3 is a real improvement. It is also one of those upgrades that gets oversold. The wins are concentrated in specific workloads: mobile, lossy networks, CDN-served static assets, real-time. For everything else, the gap from HTTP/1.1 to HTTP/2 was the big jump, and HTTP/2 to HTTP/3 is incremental. This post is the technical difference, the cases where it actually matters, and the cases where it does not.

Quick recap of the protocol generations

HTTP/1.1 (1997). One request per TCP connection at a time. Browsers worked around this by opening 6+ connections per host. Lots of TCP overhead, lots of head-of-line blocking.

HTTP/2 (2015). Multiple requests multiplexed over one TCP connection. Header compression (HPACK). Server push (rarely used in practice). Adoption: ~95% of browsers, ~80% of websites.

HTTP/3 (2022). Multiplexing over QUIC instead of TCP. QUIC is a UDP-based transport with built-in TLS. Major fix: when one packet is lost, only one stream stalls; HTTP/2 over TCP stalls all streams.

The single most important change: head-of-line blocking at the transport layer is gone.

In HTTP/2 over TCP, a single dropped packet stops all multiplexed streams until that packet is retransmitted. Your CSS, JS, fonts, images: all paused waiting for one lost byte. On a clean wired network this is rare. On mobile, with packet loss in the 0.5-2% range, it is common and visible.

QUIC handles loss per-stream. A drop affecting the CSS does not stop the JS from making progress. The protocol adapts loss control per stream rather than per connection.

That is the big idea. Other improvements:

0-RTT resumption: returning users skip the TLS handshake on subsequent connects. Saves ~100 ms per connection.
Connection migration: a phone switching from Wi-Fi to LTE keeps its QUIC connection alive (TCP would have to renegotiate). Saves a stall during network changes.
Improved congestion control by default (BBR, etc.).

When HTTP/3 wins meaningfully

The wins are concentrated, not universal:

Mobile users on lossy networks. Packet loss in the 1-3% range is where HTTP/3’s stream-isolated retransmission shines. Sites like Instagram and Facebook saw ~10% reduction in time-to-first-byte and ~5-15% LCP improvement after HTTP/3 rollout, almost entirely on mobile.

Many small assets. A page loading dozens of small JS chunks benefits more than one loading a single big bundle. The multi-stream advantage compounds with the number of streams.

CDN-served static content. Cloudflare, Fastly, AWS CloudFront all support HTTP/3 with minimal configuration. The wins for CDN traffic are real, especially for global users on suboptimal networks.

Long-lived connections that survive network changes. Mobile apps, real-time apps. Connection migration is a meaningful UX win.

When HTTP/3 doesn’t matter

A site with these characteristics will see ~zero improvement:

Desktop users on stable broadband.
Single-page app with one big JS bundle.
Same-origin API calls served alongside the main bundle (already on a warm connection).
B2B / enterprise traffic from corporate networks (where UDP-based protocols may be blocked).

The “HTTP/3 will make my site faster” expectation is mostly wrong if the user’s network is good. Most desktop benchmarks show HTTP/3 within 1-2% of HTTP/2.

Operational realities

A few things to know before flipping HTTP/3 on:

UDP gets blocked. Some corporate firewalls and ISPs drop UDP traffic on non-standard ports, or rate-limit it. Browsers fall back to HTTP/2 in that case, so HTTP/3 is additive, not replacing, but you do not get the wins for those users.

Servers are catching up. Nginx supports HTTP/3 since 1.25 (2023) but it is still considered experimental. Caddy has had it for years. HAProxy added it in 2.6. Most CDN edge servers are mature; origin servers may not be.

Observability tooling. Some monitoring tools (older versions of Wireshark, some packet captures) do not understand QUIC well. Ensure your tooling supports it before you have an incident.

0-RTT replay attacks. Early data sent in a 0-RTT request can be replayed by an attacker. Mitigations: only allow 0-RTT for idempotent requests (GET, OPTIONS), reject 0-RTT for state-changing requests. CDNs handle this by default; check before relying on it for self-hosted.

Practical advice for getting the actual win

If you want HTTP/3’s benefits with minimal effort:

Use a CDN that supports it natively. Cloudflare (free tier), Fastly, AWS CloudFront. Flip a switch in their dashboard. Done.

Verify with curl --http3 (with a recent curl build):

curl --http3 -v https://example.com 2>&1 | grep -i alt-svc

Check Alt-Svc headers are advertising HTTP/3:
```
alt-svc: h3=":443"; ma=86400
```
Watch real user metrics for mobile users specifically. Lighthouse on a fast desktop will not show the difference.

If you self-host, the lift is meaningfully higher. Wait for nginx/HAProxy/your-stack to have stable HTTP/3 support and good documentation.

What HTTP/2 is still doing for you

A reminder: most of the latency reduction over HTTP/1.1 came from HTTP/2. If you are on HTTP/2, you already have:

Multiplexed connections (no more 6-connection workaround)
Header compression (HPACK)
Stream prioritization (less so in practice; most servers don’t honor it well)
Connection reuse for SSE and other long-lived streams

The transition from HTTP/1.1 → HTTP/2 was the big win. HTTP/3 is a smaller additional improvement.

What about HTTP/2 server push?

Spec’d, optimistically marketed, rarely works well in practice. The Chrome team removed support in 2022 because it caused more harm than good, pushing assets the browser already had cached, increasing waste. Most CDNs deprecated it too.

If you were waiting for HTTP/2 push to be useful, stop waiting. Use HTTP early hints (103) instead, supported by modern Chrome and Cloudflare/Fastly, which lets the server send a Link: rel=preload hint before the full response is ready.

TLS 1.3 is the unsung hero

HTTP/3 includes TLS 1.3 by default. A separate but related improvement worth verifying:

openssl s_client -connect example.com:443 -tls1_3

TLS 1.3 reduces handshake from 2 round-trips to 1 (or 0 with resumption). Combined with 0-RTT, returning users skip a noticeable amount of overhead.

Even if you are not on HTTP/3, ensuring TLS 1.3 is enabled on your servers is a free latency win.

A few that pair with HTTP/2/3 but are independent:

Strict-Transport-Security (HSTS): forces HTTPS. Required for HTTP/2 / HTTP/3 in browsers.
Content-Encoding: br (Brotli) for static assets. 20-30% smaller than gzip for HTML/JS/CSS.
Vary: Accept-Encoding: ensures CDN serves the right compressed variant.

Brotli has more impact on bytes-on-the-wire than the protocol upgrade. Make sure it is enabled.

When to actually migrate

Three triggers that mean it is worth the effort:

Significant mobile user share (>30%) on lossy networks.
CDN migration is on the roadmap anyway; flip it on then.
Real-time / WebSocket-heavy apps where connection migration is a UX feature.

If none of those apply, leave HTTP/3 for the platform team’s “nice to have” backlog. The ROI is not there.

The takeaway

HTTP/3 is a real improvement focused on lossy networks and mobile. For most desktop / broadband traffic, it is within statistical noise of HTTP/2. The right adoption path is “turn it on at the CDN if you have one,” not “rewrite the load balancer.” Watch real user metrics, especially mobile p75/p95, before declaring victory.

Don’t oversell the migration to your team. The gap from HTTP/1.1 to HTTP/2 was the headline. HTTP/2 to HTTP/3 is an asterisk on the headline.

A note from Yojji

The kind of architectural judgment that distinguishes “this upgrade will move user-visible metrics” from “this upgrade is fashionable” is the kind of senior engineering Yojji’s teams bring to client work, including the network and CDN choices that compound into a faster site without churn for its own sake.

Yojji is an international custom software development company founded in 2016, with teams across Europe, the US, and the UK. They specialize in the JavaScript ecosystem (React, Node.js, TypeScript), cloud platforms, and full-cycle product engineering, including the protocol and infrastructure decisions that decide whether a site is genuinely faster or just appears modern.

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

The Practical Developer

Quick recap of the protocol generations

When HTTP/3 wins meaningfully

When HTTP/3 doesn’t matter

Operational realities

Practical advice for getting the actual win

What HTTP/2 is still doing for you

What about HTTP/2 server push?

TLS 1.3 is the unsung hero

When to actually migrate

The takeaway

A note from Yojji