RFC 7540 was ratified over 2 years ago and, today, all major browsers, servers, and CDNs support the next generation of HTTP. Just over a year ago, at Velocity, we discussed the protocol, looked at some real world implications of its deployment and use, and what realistic expectations we should have from its use. Now that adoption is ramped up and the protocol is being regularly used on the Internet, it's a good time to revisit the protocol and its deployment. Has it evolved? Have we learned anything? Are all the features providing the benefits we were expecting? What's next?In this session, we'll review protocol basics and try to answer some of these questions based on real-world use of it. We'll dig into the core features like interaction with TCP, server push, priorities and dependencies, and HPACK. We'll look at these features through the lens of experience and see if good practice patterns have emerged. We'll also review available tools and discuss what protocol enhancements are in the near and not-so-near horizon.

1. Revisiting HTTP/2
Hooman Beheshti

2. Yes, I like being
interviewed, but I’m tired of
hearing this guy talk about
HTTP/2

4. https://youtu.be/CkFEoZwWbGQ

5. HTTP/2
The basics

6. connection

7. connection
• A single, long lasting connection
• Theoretically, this means better congestion management
between peers
• TLS/ALPN

8. connection
stream
stream
stream
…
frame frame frame frame
frame frame frame frame
frame frame frame
frame frame frame
frame frame
frame frame frame

9. DATA Carries request or response data
HEADERS Carries request/response headers/trailers; can initiate a stream
PRIORITY Indicates priority of a stream
RST_STREAM Terminates a stream
SETTINGS Defines parameters for the connection only
PUSH_PROMISE Signals peer for server push
PING Maintenance frame for checking RTT, connection, etc
GOAWAY For shutting down a connection
WINDOW_UPDATE Frame responsible for flow control adjustments
CONTINUATION Extends a HEADERS frame and can carry more headers

10. GET /thing HTTP/1.1
Host: www.example.com
User-Agent: Some_user_agent
HTTP/1.1 200 OK
Server: some_server
Content-Type: text/html
Content-Length: 1000
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html
Request Response

11. GET /thing HTTP/1.1
Host: www.example.com
User-Agent: Some_user_agent
HTTP/1.1 200 OK
Server: some_server
Content-Type: text/html
Content-Length: 1000
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html html html
html html html html html
DATA
DATA
DATA
DATA
DATA
DATA
HEADERS
Request Response
HEADERS

12. HTTP/2 Frame
TCP
TLS
TLS Record
HTTP/2 Frame
HTTP/2 Frame
…
Stream ID
Stream ID
Stream ID
TCP
TLS
TLS Record
Header: valuern
Header: valuern
Header: valuern
rn
Body Body Body Body Body
Body Body Body Body Body
Body Body Body Body Body
Body Body Body Body Body
HTTP/1 HTTP/2

13. Protocol flow

14. HTTP/1
response
connection request

15. HTTP/2
connection
(sid=1)
DATA
(sid=1)
DATA
(sid=1)
DATA
(sid=1)
HEADERS
(sid=1)
HEADERS

16. HTTP/1
response
connection request
Head-of-line blocking:
nothing else can happen over the connection while busy with request/response

17. HTTP/1
response
connection request
response
connection request
response
connection request
response
connection request
response
connection request

18. HTTP/2
connection
(sid=3)
DATA
(sid=1)
DATA
(sid=5)
HEADERS
(sid=3)
DATA
(sid=1)
HEADERS
(sid=3)
HEADERS
(sid=11)
HEADERS
(sid=13)
HEADERS
(sid=15)
HEADERS
(sid=13)
DATA
(sid=13)
DATA
(sid=17)
HEADERS

19. Multiplexing & Interleaving

21. HTTP/1.1 HTTP/2

22. https://caniuse.com/#search=http2

23. https://istlsfastyet.com/

24. https://httparchive.org/reports/state-of-the-web#h2

25. https://twitter.com/cluffpost/status/860187740184432640

26. HTTP/2

27. HTTP/2 & TCP

28. h2 and TCP:
performance

30. PLR

31. 0% PLR 0.5% PLR
1% PLR 2% PLR

32.
0% PLR 2% PLR
5Mbps/1Mbps
40ms
780Kbps/330Kbps
200ms
5Mbps/1Mbps
40ms
780Kbps/330Kbps
200ms
Doc
Complete
h2 h2 h2 h2 h1 h1 h1 h1
DCL Start h1 h1 h2 h1 h1 h1 h2 h1
Speed
Index
h2/h1 h2 h2 h2 h1 h1 h2 h2

33. 0% PLR 2% PLR
5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms
Site1a
(Fastly)
DocComplete h2 h2 h2 h1 h1 h1 h1 h1
DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2
Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2
Site1b
DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1
DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1
Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1
Site1c
DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1
DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1
Speed Index h2 h2 h1 h2 h1 h2 h1 h1
Site2a
DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1
DCL Start h2 h2 h2 h2 h1 h1 h1 h1
Speed Index h1 h2 h1 h2 h1 h2 h1 h2
Site2b
DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1
DCL Start h2 h2 h1 h2 h1 h2 h1 h2
Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1
Site3a
DocComplete h2 h2 h1 h2 h2 h2 h1 h1
DCL Start h2 h2 h2 h2 h2 h2 h2 h2
Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1
Site3b
DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2
DCL Start h2 h2 h2 h2 h2 h2 h2 h2
Speed Index h1 h2 h1 h1 h1 h2 h1 h1
Site3c
DocComplete h1 h2 h2 h2 h1 h2 h2 h2
DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1
Speed Index h1 h2 h2 h2 h2 h2 h2 h2

34. Why?

39. Head of line blocking
in TCP

41. I really wish
there were some
academic papers on
this…

42. Some reading…
• http://c3lab.poliba.it/images/3/3b/QUIC_SAC15.pdf
• https://www.usenix.org/system/files/conference/nsdi14/nsdi14-paper-
wang_xiao_sophia.pdf
• http://arxiv.org/pdf/1507.06562v1.pdf
• http://nl.cs.montana.edu/lab/publications/Goel_H2_extended.pdf
• https://99designs.com.au/tech-blog/blog/2016/07/14/real-world-http-2-400gb-of-
images-per-day/

43. Takeaways (then)
• Despite the experiment flaws, performance
benefits are less than clear cut, out of the box
• Seemed best:
- Not listen to anyone!
- Try for yourself

44. Has anything
changed?

45. BBR

46. https://github.com/google/bbr/blob/master/Presentations/bbr-2017-02-08-google-net-research-summit.pdf

47. https://cloudplatform.googleblog.com/2017/07/TCP-BBR-congestion-control-comes-to-GCP-your-Internet-just-got-faster.html

48. Bountifully Beneficial Reading
• https://github.com/google/bbr/blob/master/Presentations/
bbr-2017-02-08-google-net-research-summit.pdf
• https://www.ietf.org/proceedings/97/slides/slides-97-iccrg-
bbr-congestion-control-02.pdf
• https://github.com/google/bbr
• https://dl.acm.org/citation.cfm?id=3009824
• https://arxiv.org/pdf/1706.09115.pdf

49. https://vimeo.com/291585392

50. https://twitter.com/amernetflix/status/892787364598132736

51. https://blogs.dropbox.com/tech/2017/09/optimizing-web-servers-for-high-throughput-and-low-latency/

52. BBR things…
• Is BBR a good network citizen?
• “network waterboarding”
• There’s still work to do

53. h2 and TCP:
coalescing

56. https://daniel.haxx.se/blog/2016/08/18/http2-connection-coalescing/

59. Origin frame
• List of domains eligible for coalescing
- Cert still needs to match
• Empty frame signals no coalescing
- Fall back to SNI
• Obviates DNS lookups for listed domains

60. Origin frame
• List of domains eligible for coalescing
- Cert still needs to match
• Empty frame signals no coalescing
- Fall back to SNI
• Obviates DNS lookups for listed domains

61. Origin frame
• List of domains eligible for coalescing
- Cert still needs to match
• Empty frame signals no coalescing
- Fall back to SNI
• Obviates DNS lookups for listed domains

62. The connection is an authoritative and secure
context

63. The connection is an authoritative and secure
context

64. The connection is an authoritative and secure
context

65. h2 and TCP
• Performance benefits?
- Anecdotal, seems to vary from case to case
- BBR helps, but pros/cons aren’t totally clear yet
- It’s still best to figure out what’s best for you on your own!
• We’re about to get more control over some coalescing
• The context of a connection is being relied on more
and more

66. HTTP/2 Server Push

67. Push basic
• “push” a resource to the client before it’s
requested
• Only servers can push
• Triggered by PUSH_PROMISE frame

68. connection

69. connection

70. connection

71. What to push?
• A replacement for inlining
- All the RTT-saving benefits + caching
• Google paper:
- https://docs.google.com/a/fastly.com/drawings/d/
1mWwY_MeNAjzDRCF0uT97KgN0lh_jX79a53X6iOuH_Is/pub?
w=2330&h=1350
• Facebook:
- https://www.facebook.com/atscaleevents/videos/1775942979345465/

72. Link: </css1.css>; rel=preload; as=style
https://w3c.github.io/preload/

73. Benefits?

74. No push:
Push:
1xRTT

75. That’s cool, but...

78. Non-header trigger

80. “Async” Push

82. Push with Link header
Async Push

83. of course it isn’t that simple…

84. The client cache

85. RST_STREAM

86. RST_STREAM

87. Push
First view
Repeat view
pushed
pushed

88. https://blog.yoav.ws/tale-of-four-caches/

89. Cache Digests
http://httpwg.org/http-extensions/cache-digest.html

90. +-------------------------------+-------------------------------+
| Origin-Len (16) | Origin? (*) ...
+-------------------------------+-------------------------------+
| Digest-Value? (*) ...
+---------------------------------------------------------------+

91. We still have work to do...
It shouldn’t be this
difficult!

92. https://jakearchibald.com/2017/h2-push-tougher-than-i-thought/

93. Adoption?
• 0.04% of HTTP/2 sessions have a push frame
• Average amount of pushed data per session: 32KB
• Success rate:
• 63.51% accepted
• 22.35% time out
• 13.39% duplicate
https://github.com/httpwg/wg-materials/blob/gh-pages/ietf102/chrome_push.pdf

95. 103

97. https://tools.ietf.org/html/rfc8297

99. Fetch stuff!!

101. {
103

102. Pushing for push
• Is the 1RTT worth the complexity?
• 103 to the browser:
- Same benefit as push for the most important use-case
- Much simpler
- Leverage browser cache
• “To push or not to push” by Patrick Hamann
- https://www.youtube.com/watch?v=cznVISavm-k
• Cache digests may still be useful?
• What do we do with push?

103. Prioritization
Priority #1: skiing
h2 priority?
h2 schmriority

104. Prioritization basics
• Address possible contention because of all the
concurrency
• Stream weights
• Dependency (including exclusivity)
• HEADERS and PRIORITY frames
• It’s only a “suggestion”

105. Example
• D gets all resources
• After D is done:
- C gets ½ of resources
- E gets ½ of resources
• After C is done:
- A gets ¾ of C’s ½ of resources
- B gets ¼ of C’s ½ of resources
*
D
1
C
8
A
12
B
4
E
8

106. https://speakerdeck.com/summerwind/2-prioritization

107. https://speakerdeck.com/summerwind/2-prioritization

108. https://speakerdeck.com/summerwind/2-prioritization

110. https://speakerdeck.com/summerwind/2-prioritization

111. https://github.com/deweerdt/h2priograph
Chrome/71.0.3555.0

113. https://github.com/deweerdt/h2priograph

114. https://github.com/deweerdt/h2priograph

115. Priority hints

116. https://discourse.wicg.io/t/manual-priority-control-of-resource-fetching/2280
https://github.com/WICG/priority-hints

117. Tools and resources

118. http://chimera.labs.oreilly.com/books/1230000000545

119. Browser indicator
• Chrome:
– https://chrome.google.com/webstore/detail/http2-and-spdy-
indicator/mpbpobfflnpcgagjijhmgnchggcjblin?hl=en
• Firefox:
– https://addons.mozilla.org/en-US/firefox/addon/http2-indicator/

120. Dev tools

121. Wireshark
Using the TLS key file:
https://jimshaver.net/2015/02/11/decrypting-tls-browser-traffic-with-wireshark-the-easy-way/

122. cURL
https://curl.haxx.se/docs/http2.html

123. cURL
https://daniel.haxx.se/blog/2018/01/15/inspect-curls-tls-traffic/

124. nghttp
https://nghttp2.org/

125. Others
• h2c (and wiretapping):
- https://github.com/fstab/h2c
• h2a: reverse proxy
- https://github.com/summerwind/h2a
• Conformance:
- https://github.com/summerwind/h2spec
• Serves and proxies:
- Charles proxy: https://www.charlesproxy.com
- MITM proxy: https://mitmproxy.org/
- h2o: https://h2o.examp1e.net/
- Envoy: https://www.envoyproxy.io/
• http-wg
- https://github.com/http2/http2-spec/wiki/Tools

126. Is this EVER going to end??!!

127. What’s next?

128. 0.9 1.0 1.1 2.0
HTTP
complexity
HTTP version

129. 0.9 1.0 1.1 2.0
HTTP
complexity
My age
HTTP version

130. HTTP
complexity
Hooman’s age
0.9
1.0
1.1 2.0

131. QUIC

132. QUIC

133. gQUIC vs iQUIC

134. gQUIC vs iQUIC
• Monolithic
• Google proprietary
• Modularized
• IETF standard

135. IP
TCP
UDP
TLS
HTTP/2
QUIC
TCP-like congestion
avoidance, recovery
HTTP/2 shim
UDP
QUIC
TCP-like congestion
avoidance, recovery
Application (HTTP/2)
QUIC crypto TLS 1.3
gQUIC iQUIChttp/2
https://datatracker.ietf.org/meeting/98/materials/slides-98-edu-sessf-quic-tutorial/

137. The promise of QUIC
• Low latency connection setup
- 0RTT
• UDP
- Addresses TCP’s head of line blocking in h2
- More flexible congestion avoidance algorithms
- “rich signaling for congestion control and loss recovery”
• Everything authenticated and encrypted
• Mitigating middle box tomfoolery
• Connection migration and NAT rebinding (via connection IDs)

138. Some QUIC reading
• https://dl.acm.org/citation.cfm?id=3098842
• https://quicwg.github.io/
• https://github.com/quicwg
• And a video: https://vimeo.com/227461189

139. So…
• Has much changed?
• Do we still have a lot to learn?
• Do we still have a lot to do?
• QUIC will fix everything, right?

140. Thank you