HTTP/2 (originally named HTTP/2.0) is the second major version of the HTTP network protocol used by the World Wide Web. It is based on SPDY. HTTP/2 was developed by the Hypertext Transfer Protocol working group (httpbis, where bis means "repeat" or "twice") of the Internet Engineering Task Force. HTTP/2 is the first new version of HTTP since HTTP 1.1, which was standardized in RFC 2068 in 1997. The Working Group presented HTTP/2 to IESG for consideration as a Proposed Standard in December 2014, and IESG approved it to publish as Proposed Standard on Feb 17, 2015. The HTTP/2 specification was published as RFC 7540 in May 2015.
The standardization effort came as an answer to SPDY, an HTTP-compatible protocol developed by Google and supported in Chrome, Opera, Firefox, Internet Explorer 11, Safari, and Amazon Silk browsers.
The working group charter mentions several goals and issues of concern:
- Negotiation mechanism that allows clients and servers to elect to use HTTP 1.1, 2.0, or potentially other non-HTTP protocols.
- Maintain high-level compatibility with HTTP 1.1 (for example with methods, status codes, and URIs, and most header fields)
- Decrease latency to improve page load speed in web browsers by considering:
- Support common existing use cases of HTTP, such as desktop web browsers, mobile web browsers, web APIs, web servers at various scales, proxy servers, reverse proxy servers, firewalls, and content delivery networks
Differences from HTTP 1.1
The proposed changes do not require any changes to how existing web applications work, but new applications can take advantage of new features for increased speed.
HTTP/2 leaves most of HTTP 1.1's high level syntax, such as methods, status codes, header fields, and URIs, the same. The element that is modified is how the data is framed and transported between the client and the server.
Websites that are efficient minimize the number of requests required to render an entire page by minifying (reducing the amount of code and packing smaller pieces of code into bundles, without reducing its ability to function) resources such as images and scripts. However, minification is not necessarily convenient nor efficient, and may still require separate HTTP connections to get the page and the minified resources. HTTP/2 allows the server to "push" content, that is, to respond with data for more queries than the client requested. This allows the server to supply data it knows a web browser will need to render a web page, without waiting for the browser to examine the first response, and without the overhead of an additional request cycle.
Additional performance improvements in the first draft of HTTP/2 (which was a copy of SPDY) come from multiplexing of requests and responses to avoid the head-of-line blocking problem in HTTP 1 (even when HTTP pipelining is used), header compression, and prioritization of requests.
Genesis in and later differences from SPDY
SPDY (pronounced like "speedy") is a research project spearheaded by Google that is also an applicable protocol, designed for the transportation of information and other content on the web. SPDY primarily focuses on reducing latency. SPDY uses the same TCP pipe but different protocols to accomplish this reduction. The basic changes made to HTTP 1.1 to create SPDY include: "true request pipelining without FIFO restrictions, message framing mechanism to simplify client and server development, mandatory compression (including headers), priority scheduling, and even bi-directional communication".
The httpbis working group considered Google's SPDY protocol, Microsoft's HTTP Speed+Mobility proposal (SPDY based), and Network-Friendly HTTP Upgrade. In July 2012 Facebook provided feedback on each of the proposals and recommended HTTP/2 be based on SPDY. The initial draft of HTTP/2 was published in November 2012 and was based on a straight copy of SPDY.
The biggest difference between HTTP/1.1 and SPDY, is that each user action in SPDY is given a "stream ID", meaning there is a single TCP channel connecting the user to the server. SPDY splits requests into either control or data, which is a "simple to parse binary protocol with two types of frames." SPDY has shown evident improvement from HTTP, with a new page load speedup ranging from 11.81% to 47.7%.
HTTP/2 uses SPDY as a jumping-off point. HTTP/2, however, uses a fixed Huffman code-based header compression algorithm, instead of SPDY's dynamic stream-based compression. This helps to reduce the potential for attacks on the protocol.
On February 9, 2015, Google announced plans to remove support for SPDY in Chrome by early 2016, in favor of support for HTTP/2, starting with Chrome 40.
Although the standard itself does not require usage of encryption, most client implementations (Firefox, Chrome) have stated that they will only support HTTP/2 over TLS, which makes encryption de facto mandatory.
HTTP/2 development process and the protocol itself faced a lot of criticism.
It has been pointed out that the standard was being prepared on an unrealistically short schedule, ruling out any basis for the new HTTP/2 other than the SPDY protocol and resulted in missing a lot of ripe opportunities.
The protocol itself is criticized for being inconsistent and having needless, overwhelming complexity. It also violates protocol layering principle, for example by duplicating flow control with transport layer (TCP). The most discussions, however, have been caused by encryption-related issues.
Initially, some members of Working Group were trying to push an encryption requirement into the protocol. This faced criticism, because encrypted connections require more server and client computing power and their initialization takes noticeably more time. Critics stated that many HTTP applications (like big news sites for example) have actually no need for encryption and their providers have no desire to spend additional resources on it. Poul-Henning Kamp, lead developer of varnish HTTP accelerator and a senior FreeBSD kernel developer, has criticised IETF for following a particular political agenda with HTTP/2. The criticism of the agenda of mandatory encryption within the existing certificate framework is not new, nor is it unique to members of the open-source community – a Cisco employee pointed out in 2013 that the present certificate model is not compatible with small devices like the routers, because the present model requires not only annual enrollment and remission of non-trivial fees for each certificate, but must be continually repeated on an annual basis. Working Group finally did not reach consensus over the mandatory encryption, although most client implementations require it, which makes encryption a de facto requirement.
The HTTP/2 protocol also faced criticism for not supporting opportunistic encryption, a feature like STARTTLS that has long been available in other internet protocols like SMTP. It has been pointed out that the HTTP/2 proposal goes in violation of IETF's own RFC7258 "Pervasive Monitoring Is an Attack", which also has a status of Best Current Practice 188. RFC7258/BCP188 mandates that passive monitoring be considered as an attack, and protocols designed by IETF should take steps to protect against passive monitoring (for example, through the use of opportunistic encryption). A number of specifications for opportunistic encryption of HTTP/2 have been provided, of which draft-ietf-httpbis-http2-encryption-01 is an official work item of the working group.
|Done||Dec 20, 2007||First HTTP 1.1 Revision Internet Draft|
|Done||January 23, 2008||First HTTP Security Properties Internet Draft|
|Done||Early 2012||Call for Proposals for HTTP 2.0|
|Done||Oct 14, 2012 – Nov 25, 2012||Working Group Last Call for HTTP 1.1 Revision|
|Done||Nov 28, 2012||First WG draft of HTTP 2.0, based upon draft-mbelshe-httpbis-spdy-00|
|Held/Eliminated||Working Group Last Call for HTTP Security Properties|
|Done||Sep 2013||Submit HTTP 1.1 Revision to IESG for consideration as a Proposed Standard|
|Done||Feb 12, 2014||IESG approved HTTP 1.1 Revision to publish as a Proposed Standard|
|Done||June 6, 2014||Publish HTTP 1.1 Revision as RFC 7230, 7231, 7232, 7233, 7234, 7235|
|Done||Aug 1, 2014 – Sep 1, 2014||Working Group Last call for HTTP/2|
|Done||Dec 16, 2014||Submit HTTP/2 to IESG for consideration as a Proposed Standard|
|Done||Dec 31, 2014 – Jan 14, 2015||IETF Last Call for HTTP/2|
|Done||Jan 22, 2015||IESG telechat to review HTTP/2 as Proposed Standard|
|Done||Feb 17, 2015||IESG approved HTTP/2 to publish as Proposed Standard|
|Done||May 14, 2015||Publish HTTP/2 as RFC 7540|
- Chrome supports HTTP/2 by default (verified as of version 41 using Akamai's HTTP/2 browser support detector). Currently only HTTP/2 over TLS is implemented. As of February 2015, Google plans to fully implement HTTP/2 in future versions of its Chrome browser and will remove support for SPDY.
- Google Chrome Canary supports HTTP/2 by default (verified as of version 43 using Akamai's HTTP/2 browser support detector). Canary version 43 supports identifying servers using the final version of the draft (h2-17) as indicated on this post by Ilya Grigorik
- Chrome for iOS supports HTTP/2 by default (verified as of version 41 using Akamai's HTTP/2 browser support detector).
- Firefox supports HTTP/2 which has been enabled by default since version 36. Experimental support for HTTP/2 was originally added in version 34. Currently only HTTP/2 over TLS is implemented.
- Internet Explorer supports HTTP/2 in version 11, but only for Windows 10 beta, and is enabled by default. Currently only HTTP/2 over TLS is implemented.
- Opera supports HTTP/2 by default (verified as of version 28 using Akamai's HTTP/2 browser support detector).
- Safari supports HTTP/2 in version 8.1, but only for OS X v10.11 El Capitan and iOS 9.
- IIS supports HTTP/2 in Windows 10 beta
- OpenLiteSpeed 1.3.11 and 1.4.8 support HTTP/2
- LiteSpeed Web Server 5.0 support HTTP/2 
- Akamai Edge Servers support HTTP/2 (draft 14 as of March 23, 2015). http2.akamai.com showcases Akamai HTTP/2 implementation.
- Jetty 9.3 supports HTTP/2 
- Apache 2.4.12 supports HTTP/2 via the module mod_h2, although appropriate patches must be applied to the source code of the server in order for it to support that module. The next release of Apache should already have these patches included. Old versions of SPDY were supported via the module mod_spdy, however the development of the module has stopped.
- SPDY, but no HTTP/2
- nginx provides experimental support for SPDY (Draft 3.1) via a module and plans to support HTTP/2 by the end of 2015
- Not planned
- Other implementations are collected on the GitHub HTTP/2 wiki.
- Bright, Peter (Feb 18, 2015). "HTTP/2 finished, coming to browsers within weeks". Ars Technica.
- Thomson, M. (ed. ), Belshe M. and R. Peon. "Hypertext Transfer Protocol version 2 - draft-ietf-httpbis-http2-16". ietf.org. HTTPbis Working Group. Retrieved 11 February 2015.
- "Hypertext Transfer Protocol Bis (httpbis) - Charter". Internet Engineering Task Force. 2012.
- "History for draft-ietf-httpbis-http2-16". IETF. Retrieved 2015-01-03.
2014-12-16 IESG state changed to Publication Requested
- Raymor, Brian (August 7, 2014). "Wait for it – HTTP/2 begins Working Group Last Call!". Microsoft Open Technologies. Retrieved 2014-09-07.
- The IESG (17 Feb 2015). "Protocol Action: 'Hypertext Transfer Protocol version 2' to Proposed Standard (draft-ietf-httpbis-http2-17.txt)". httpbis (Mailing list). Retrieved 18 February 2015.
- Mark Nottingham (February 18, 2015). "HTTP/2 Approved". www.ietf.org. Internet Engineering Task Force. Retrieved March 8, 2015.
- "RFC 7540 - Hypertext Transfer Protocol Version 2 (HTTP/2)". IETF. May 2015. Retrieved 14 May 2015.
- Sebastian Anthony (March 28, 2012). "S&M vs. SPDY: Microsoft and Google battle over the future of HTTP 2.0". ExtremeTech.
- "Can the rise of SPDY threaten HTTP?". blog.restlet.com. Restlet, Inc. October 2011.
- Ilya Grigorik. "Chapter 12: HTTP 2.0". High Performance Browser Networking. O'Reilly Media, Inc. Retrieved 19 March 2014.
- Pratt, Michael. "Apiux". apiux.com. Retrieved 19 March 2014.
- Dio Synodinos (November 2012). "HTTP 2.0 First Draft Published". InfoQ.com (C4Media Inc.).
- Grigorik, Ilya. "Life beyond HTTP 1.1: Google's SPDY".
- Willy Tarreau; Amos Jeffries; Adrien de Croy; Poul-Henning Kamp (March 29, 2012). "Proposal for a Network-Friendly HTTP Upgrade". Network Working Group. Internet Engineering Task Force.
- Doug Beaver (July 15, 2012). "HTTP2 Expression of Interest" (mailing list). W3C.
- Dio Synodinos (2012-11-30). "HTTP/2 First Draft Published". InfoQ.
- "SPDY: An experimental protocol for a faster web". The Chromium Projects.
- Chris Bentzel; Bence Béky (2015-02-09). "Hello HTTP/2, Goodbye SPDY". Chromium Blog.
- Belshe, M.; Peon, R.; Thomson, M. "Hypertext Transfer Protocol Version 2, Use of TLS Features". Retrieved 2015-02-10.
- "HTTP/2 Frequently Asked Questions". IETF HTTP Working Group. Retrieved 2014-09-08.
- "Networking/http2". MozillaWiki. Retrieved 2014-09-07.
- Kamp, Poul-Henning (2015-01-06). "HTTP/2.0 – The IETF is Phoning It In (Bad protocol, bad politics)". ACM Queue. Retrieved 2015-01-12.
- Kamp, P. H. (2015). "Http/2.0". Communications of the ACM 58 (3): 40. doi:10.1145/2717515.
- Kamp, Poul-Henning (2015-01-07). "Re: Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard". email@example.com (Mailing list). Retrieved 2015-01-12.
- Lear, Eliot (2013-08-25). "Mandatory encryption *is* theater". firstname.lastname@example.org (Mailing list). Retrieved 2015-01-26.
- Murenin, Constantine A. (2015-01-09). "Re: Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard". email@example.com (Mailing list). Retrieved 2015-01-12.
- Paul Hoffman. "draft-hoffman-httpbis-minimal-unauth-enc-01 - Minimal Unauthenticated Encryption (MUE) for HTTP-2". Internet Engineering Task Force.
- Mark Nottingham; Martin Thomson. "draft-nottingham-http2-encryption-03 - Opportunistic Encryption for HTTP URIs". Internet Engineering Task Force.
- Mark Nottingham; Martin Thomson. "draft-ietf-httpbis-http2-encryption-01 - Opportunistic Security for HTTP". Internet Engineering Task Force.
- Nottingham, Mark (7 June 2014). "RFC2616 is Dead". Retrieved 20 September 2014.
- "HTTP/1.1, part 1: URIs, Connections, and Message Parsing - draft-ietf-httpbis-p1-messaging-00". December 20, 2007. Retrieved 20 September 2014.
- "Security Requirements for HTTP - draft-ietf-httpbis-security-properties-00.txt". January 23, 2008. Retrieved 20 September 2014.
- Nottingham, Mark (24 Jan 2012). "Rechartering HTTPbis". Retrieved 20 September 2014.
- Nottingham, Mark (14 Oct 2012). "Working Group Last Call for HTTP/1.1 p1 and p2". Retrieved 20 September 2014.
- Nottingham, Mark (23 Oct 2012). "Second Working Group Last Call for HTTP/1.1 p4 to p7". Retrieved 20 September 2014.
- "SPDY Protocol - draft-ietf-httpbis-http2-00". HTTPbis Working Group. November 28, 2012. Retrieved 20 September 2014.
- Nottingham, Mark (30 Nov 2012). "First draft of HTTP/2". Retrieved 20 September 2014.
- "Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing". Archived from the original on 2014-08-13. Retrieved 20 September 2014.
- "Last Call: <draft-ietf-httpbis-p1-messaging-24.txt> (Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing) to Proposed Standard". The IESG. 21 Oct 2013. Retrieved 20 September 2014.
- The IESG (12 Feb 2014). "Protocol Action: 'Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing' to Proposed Standard (draft-ietf-httpbis-p1-messaging-26.txt)". ietf-announce (Mailing list). Retrieved 18 January 2015.
- The RFC Editor Team (6 Jun 2014). "RFC 7230 on Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing". ietf-announce (Mailing list). Retrieved 18 January 2015.
- Nottingham, Mark (1 Aug 2014). "Working Group Last Call: draft-ietf-httpbis-http2-14 and draft-ietf-httpbis-header-compression-09". HTTP Working Group. Retrieved 2014-09-07.
- "Last Call: <draft-ietf-httpbis-http2-16.txt> (Hypertext Transfer Protocol version 2) to Proposed Standard from The IESG on 2014-12-31". Internet Engineering Task Force. 2014. Retrieved 1 January 2015.
- "IESG Agenda: 2015-01-22". IETF. Archived from the original on 2015-01-15. Retrieved 15 January 2015.
- The RFC Editor Team (14 May 2015). "RFC 7540 on Hypertext Transfer Protocol Version 2 (HTTP/2)". ietf-announce (Mailing list).
- Nottingham, Mark (4 January 2014). "Strengthening HTTP: A Personal View". Retrieved 8 October 2014. (section "Enter Snowden")
- Paul, Ian (10 February 2015). "Google Chrome embraces the faster, more secure next-gen HTTP 2.0 standard". PCWorld. Retrieved 13 February 2015.
- "Bug 1097320". Bugzilla@Mozilla. 2014-11-26. Retrieved 2015-01-24.
- Patrick McManus (2014-10-03). "Bug 1047594 - Enable http/2 (and alpn) by default". Bugzilla@Mozilla. Retrieved 8 October 2014.
- "Firefox Notes (34.0.5)". Mozilla. 2014-12-01. Retrieved 2 December 2014.
- Rob Trace, David Walp (October 8, 2014). "HTTP/2: The Long-Awaited Sequel". Microsoft. Retrieved 8 October 2014.
- Rob Trace; David Walp (October 8, 2014). "HTTP/2: The Long-Awaited Sequel". MSDN IEBlog. Microsoft Corporation.
- "OpenLiteSpeed 1.4.5 change log". LiteSpeed Technologies, Inc. 2015-02-26. Retrieved 26 February 2015.
- "LSWS 5.0 Is Out – Support for HTTP/2, ESI, LiteMage Cache". April 17, 2015.
- "Jetty change log". Eclipse Foundation. 2015-05-28. Retrieved 28 May 2015.
- https://icing.github.io/mod_h2/. Missing or empty
- Matthew Steele (June 19, 2014). "mod_spdy is now an Apache project". Google Developers Blog.
- "Log of /httpd/mod_spdy". svn.apache.org. Retrieved March 2015.
- "Module ngx_http_spdy_module". nginx.org. Retrieved 10 February 2015.
- Owen Garrett (February 25, 2015). "How NGINX Plans to Support HTTP/2". NGINX Blog. Retrieved 1 March 2015.
- stbuehler. "lighttpd Feature #2322 - Support for SPDY protocol". Lighttpd.
- Official website
- RFC 7540 - Hypertext Transfer Protocol version 2 (HTTP/2)
- RFC 7541 - HPACK: Header Compression for HTTP/2
- SPDY Protocol (draft-mbelshe-httpbis-spdy-00)
- HTTP Speed+Mobility (draft-montenegro-httpbis-speed-mobility-01)
- Proposal for a Network-Friendly HTTP Upgrade (draft-tarreau-httpbis-network-friendly-00)