Protocols

What is HTTP/3?

HTTP/3 is HTTP carried over QUIC, which runs on UDP and builds the TLS 1.3 handshake into the transport itself. It keeps HTTP semantics and HTTP/2-style multiplexing while removing TCP's head-of-line blocking, so a lost packet stalls only its own stream. Clients discover it from an Alt-Svc header or an HTTPS DNS record and negotiate it as h3.

A QUIC connection is identified by a connection ID rather than by an address and port pair, so a phone moving from Wi-Fi to a mobile network keeps the session instead of starting over. Transport setup and cryptographic setup happen together, which usually costs one round trip and none at all when a client resumes a session with 0-RTT. Header compression moves from HPACK to QPACK (RFC 9204), which adds ordering rules so that a lost packet cannot leave the two ends disagreeing about the shared table.

Classic proxies are the sticking point. HTTP CONNECT builds a TCP tunnel and nothing else, so HTTP/3 cannot travel through one, and while SOCKS5 could in principle carry it over UDP ASSOCIATE, few providers implement that command. In practice Chrome sends no QUIC at all through a configured proxy and falls back to HTTP/2 over TCP, which anyone can watch happen in devtools. Later work on CONNECT-UDP and MASQUE defines a proper way to proxy datagrams, with support still thin outside a handful of networks.

Firewalls in corporate networks and some carriers block or throttle UDP on port 443, and clients cope by racing a QUIC attempt against a TCP one and keeping whichever answers first. That fallback hides breakage well, so a site you assume is running h3 may have been on HTTP/2 for you the whole time. Middleboxes see far less than they used to, because QUIC encrypts most of its transport headers, which is part of why some operators would rather block it than pass it through.

For scraping and automation the answer stays simple. Most tooling ends up on HTTP/2 or HTTP/1.1, whether that is a curl build without HTTP/3 compiled in, a browser driven by Playwright behind a proxy, or an ordinary HTTP library, and origins keep serving those versions. No site can demand h3 yet, since too many legitimate clients cannot reach it. The angle worth watching is fingerprinting, because QUIC transport parameters vary between implementations much as TLS extensions do.

Where you meet it

You notice HTTP/3 mainly by its absence. Traffic through a proxy arrives as HTTP/2, devtools show h2 where a direct visit showed h3, and the timing difference on a lossy mobile link gets blamed on the proxy. That is expected rather than a fault. If you are measuring real user performance on mobile networks, benchmark the direct and proxied paths separately, since they are not running the same transport underneath.

Common questions

Can I use HTTP/3 through a proxy?

Rarely today. HTTP CONNECT tunnels carry TCP only, and SOCKS5 support for UDP relaying is uncommon among commercial providers, so browsers fall back to HTTP/2 when a proxy is configured. CONNECT-UDP and MASQUE were designed to fix this, and deployment is limited. For most work the fallback is harmless.

Is HTTP/3 the same as QUIC?

No. QUIC is the transport protocol, running over UDP with encryption and stream multiplexing built in. HTTP/3 is the mapping of HTTP onto QUIC, adding QPACK header compression and its own frame types. Other protocols can run over QUIC too, so the two names describe different layers.

Does blocking HTTP/3 break websites?

Almost never. Clients race a QUIC connection against a TCP one and use whichever succeeds, so blocked UDP on port 443 means pages load over HTTP/2 instead. You may lose some performance on lossy networks and on connections that change address mid-session, and the content itself is identical.

Related terms

HTTP/2
HTTP/2 is a binary version of HTTP that carries many concurrent requests as multiplexed streams over a single TCP connection and compresses headers with HPACK. It keeps HTTP's methods, status codes and header semantics unchanged, so only the wire format differs. Browsers negotiate it during the TLS handshake through ALPN, advertising the identifier h2.
QUIC
QUIC is an encrypted transport protocol that runs over UDP instead of TCP and carries HTTP/3 traffic, normally on UDP port 443. It combines the transport and TLS 1.3 handshakes into one exchange and multiplexes independent streams without head-of-line blocking. The protocol identifies a connection by an ID rather than by an address and port pair.
HTTP Proxy
An HTTP proxy is a server that forwards HTTP requests on a client's behalf, parsing the protocol rather than blindly relaying bytes. The client sends the full target URL in the request line, or issues a CONNECT to tunnel an HTTPS session. Proxies conventionally listen on ports such as 8080 or 3128; port 80 belongs to the origin web server.
HTTPS Proxy
An HTTPS proxy carries encrypted TLS traffic between a client and a destination site, usually by opening a tunnel with the HTTP CONNECT method to port 443. The proxy relays raw bytes without reading the request path, headers or body. The term also describes a proxy whose own listening port accepts a TLS-encrypted client connection.
SOCKS5
SOCKS5 is a session-layer proxy protocol, defined in RFC 1928, that relays TCP connections and can relay UDP datagrams for any application rather than only web traffic. It negotiates an authentication method first, then takes a target given as an IPv4 address, an IPv6 address or a domain name and forwards bytes without interpreting them.
SOCKS4
SOCKS4 is the earlier version of the SOCKS proxy protocol. It relays TCP connections only and addresses targets by raw IPv4 address, with no authentication beyond a user ID string the proxy may ignore. The SOCKS4a extension adds hostname support. SOCKS5 superseded it, and current clients keep SOCKS4 only for legacy endpoints.
SSL/TLS
SSL and TLS are the protocols that encrypt and authenticate traffic between a client and a server. SSL is the deprecated original; TLS is what runs today, with TLS 1.2 and TLS 1.3 the only versions current software should negotiate. The handshake proves the server's identity with a certificate, then agrees the keys used for the session.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary