Fastly, profile picture
Uploaded byFastly
PDF, PPTX17,796 views

HTTP/2: What no one is telling you

The document discusses the HTTP/2 protocol, highlighting its improved speed and efficiency over HTTP/1.1, including features like multiplexing, stream prioritization, and connection reuse. It provides technical details and performance comparisons, including various bandwidth and latency scenarios, to illustrate the advantages of HTTP/2 in real-world applications. The analysis extensively covers different metrics for assessing web performance across multiple sites.

Embed presentation

Download as PDF, PPTX
1 / 158
2 / 158
3 / 158
Most read
4 / 158
Most read
5 / 158
6 / 158
7 / 158
8 / 158
9 / 158
10 / 158
11 / 158
12 / 158
13 / 158
14 / 158
15 / 158
16 / 158
Most read
17 / 158
18 / 158
19 / 158
20 / 158
21 / 158
22 / 158
23 / 158
24 / 158
25 / 158
26 / 158
27 / 158
28 / 158
29 / 158
30 / 158
31 / 158
32 / 158
33 / 158
34 / 158
35 / 158
36 / 158
37 / 158
38 / 158
39 / 158
40 / 158
41 / 158
42 / 158
43 / 158
44 / 158
45 / 158
46 / 158
47 / 158
48 / 158
49 / 158
50 / 158
51 / 158
52 / 158
53 / 158
54 / 158
55 / 158
56 / 158
57 / 158
58 / 158
59 / 158
60 / 158
61 / 158
62 / 158
63 / 158
64 / 158
65 / 158
66 / 158
67 / 158
68 / 158
69 / 158
70 / 158
71 / 158
72 / 158
73 / 158
74 / 158
75 / 158
76 / 158
77 / 158
78 / 158
79 / 158
80 / 158
81 / 158
82 / 158
83 / 158
84 / 158
85 / 158
86 / 158
87 / 158
88 / 158
89 / 158
90 / 158
91 / 158
92 / 158
93 / 158
94 / 158
95 / 158
96 / 158
97 / 158
98 / 158
99 / 158
100 / 158
101 / 158
102 / 158
103 / 158
104 / 158
105 / 158
106 / 158
107 / 158
108 / 158
109 / 158
110 / 158
111 / 158
112 / 158
113 / 158
114 / 158
115 / 158
116 / 158
117 / 158
118 / 158
119 / 158
120 / 158
121 / 158
122 / 158
123 / 158
124 / 158
125 / 158
126 / 158
127 / 158
128 / 158
129 / 158
130 / 158
131 / 158
132 / 158
133 / 158
134 / 158
135 / 158
136 / 158
137 / 158
138 / 158
139 / 158
140 / 158
141 / 158
142 / 158
143 / 158
144 / 158
145 / 158
146 / 158
147 / 158
148 / 158
149 / 158
150 / 158
151 / 158
152 / 158
153 / 158
154 / 158
155 / 158
156 / 158
157 / 158
158 / 158
Hooman Beheshti VP Technology HTTP/2: What no one’s telling you
some people are starting to tell you! Hooman Beheshti VP Technology HTTP/2: What no one’s telling you
Everything will be much faster! You don’t need to change anything! Google said so! You can stop doing optimizations!
2 > 1.1
Goals •  Take an objective look at the protocol •  Practical considerations •  Share data •  Better understand the good –  And the bad?
HTTP/2 RFC 7540
Binary protocol
Connection
connection
A single connection •  single, long-lasting TCP connection •  Theoretically, this means better congestion management between peers •  TLS (with ALPN) •  Connection reuse across domains (same IP and cert)
Streams
connection stream stream stream …
Streams •  Virtual channels for communication –  Translate roughly to a request/response exchange –  Client or server can initiate or terminate •  Stream IDs: –  Client: odd; server: even; 0: reserved –  Each ID has to be larger than the ones before it initiated by the endpoint –  Cannot be reused
Frames
connection stream stream stream … frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame
GET /thing HTTP/1.1 Host: www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html Request Response
GET /thing HTTP/1.1 Host: www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html HEADERS Request Response
GET /thing HTTP/1.1 Host: www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html HEADERS HEADERS Request Response
GET /thing HTTP/1.1 Host: www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html DATA DATA DATA DATA DATA DATA HEADERS HEADERS Request Response
DATA Carries request or response data HEADERS Carries request/response headers/trailers; can initiate a stream PRIORITY Indicates priority of a stream RST_STREAM Terminates a stream SETTINGS Defines parameters for the connection only PUSH_PROMISE Signals peer for server push PING Maintenance frame for checking RTT, connection, etc GOAWAY For shutting down a connection WINDOW_UPDATE Frame responsible for flow control adjustments CONTINUATION Extends a HEADERS frame and can carry more headers
DATA Carries request or response data HEADERS Carries request/response headers/trailers; can initiate a stream PRIORITY Indicates priority of a stream RST_STREAM Terminates a stream SETTINGS Defines parameters for the connection only PUSH_PROMISE Signals peer for server push PING Maintenance frame for checking RTT, connection, etc GOAWAY For shutting down a connection WINDOW_UPDATE Frame responsible for flow control adjustments CONTINUATION Extends a HEADERS frame and can carry more headers
Protocol flow
HTTP/1 connection request response
HTTP/2 connection (sid=1) DATA (sid=1) DATA (sid=1) DATA (sid=1) HEADERS (sid=1) HEADERS
HTTP/1 connection request response
connection request response HTTP/1 connection request response connection request response connection request response
HTTP/2 connection (sid=3) DATA (sid=1) DATA (sid=5) HEADERS (sid=3) DATA (sid=1) HEADERS (sid=3) HEADERS (sid=11) HEADERS (sid=13) HEADERS (sid=15) HEADERS (sid=13) DATA (sid=13) DATA (sid=17) HEADERS
HTTP/1.1
HTTP/1.1 HTTP/2
http://caniuse.com/#search=http2
Servers •  Apache & Nginx •  h2o –  https://h2o.examp1e.net/ •  https://en.wikipedia.org/wiki/HTTP/2 •  Talk to your CDNs
Performance
The perfect page
Private WebpageTest 5Mbps/1Mbps; 40ms latency Chrome; h1 vs h2
Private WebpageTest 5Mbps/1Mbps; 40ms latency Chrome; h1 vs h2 ~270 runs each!!
Packet Loss!
Firefox
Slow 3G: 780Kbps/330Kbps 200ms latency
Firefox; Slow 3G: 780Kbps/330Kbps, 200ms latency
Firefox; 5Mbps/1Mbps, 40ms latency
5Mbps/1Mbps, 40ms latency
      0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms DocComplete h2 h2 h2 h2 h1 h1 h1 h1 Keeping score…
      0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms DocComplete h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1 h2 h1 h1 h1 h2 h1 Speed Index h2/h1 h2 h2 h2 h1 h1 h2 h2 Keeping score…
Why?
Head of line blocking in TCP
Real pages
Real pages •  8 pages (from 8 real sites) •  16 bandwidth/latency combinations –  Each with 0%, 0.5%, 1%, 2% PLR •  Firefox and Chrome, TLS only, collect all metrics •  300-400 runs with each combination
Real pages •  8 pages (from 8 real sites) •  16 bandwidth/latency combinations –  Each with 0%, 0.5%, 1%, 2% PLR •  Firefox and Chrome, TLS only, collect all metrics •  300-400 runs with each combination
Analysis •  3 Types of pages, # of resources h1àh2: –  ~75% or higher –  ~half –  ~25% or lower •  2 profiles (0%, 0.5%, 1%, 2% PLR): –  “Broadband”: 5Mbps/1Mbps/40ms –  “Slow 3G”: 780Kbps/330Kbps/200ms •  3 Metrics –  Document Complete –  DOM Content Loaded Start –  Speed Index
Site1: Fastly customers page 130-135 requests to onload (~3MB) ~99 requests h1àh2 (2.5MB)
Site1; DocComplete; 5Mbps/1Mbps/40ms
Site1; DCL; 5Mbps/1Mbps/40ms
Site1; Speed Index; 5Mbps/1Mbps/40ms
Site1; DocComplete; 780Kbps/330Kbps/200ms
Site1; DCL; 780Kbps/330Kbps/200ms ***
Site1; Speed Index; 780Kbps/330Kbps/200ms
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2
Site2 90-100 requests to onload (~1.7MB) ~47 requests h1àh2 (1.2MB)
Site2; DocComplete; 5Mbps/1Mbps/40ms
Site2; DCL; 5Mbps/1Mbps/40ms
Site2; Speed Index; 5Mbps/1Mbps/40ms
Site2; DocComplete; 780Kbps/330Kbps/200ms
Site2; DCL; 780Kbps/330Kbps/200ms
Site2; Speed Index; 780Kbps/330Kbps/200ms ***
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2       Site2 DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2
Site3 176-212 requests to onload (~3.5MB) ~45-55 requests h1àh2 (2MB)
Site3; DocComplete; 5Mbps/1Mbps/40ms ***
Site3; DCL; 5Mbps/1Mbps/40ms
Site3; Speed Index; 5Mbps/1Mbps/40ms
Site3; DocComplete; 780Kbps/330Kbps/200ms
Site3; DCL; 780Kbps/330Kbps/200ms
Site3; Speed Index; 780Kbps/330Kbps/200ms
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2       Site2 DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2       Site3 DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
0% PLR 2% PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
Trends? •  Metrics later in the page seem to get affected more by packet loss (?) •  Lots of exceptions –  Sometimes h2 holds up even under loss conditions –  Sometimes h1 wins even when there’s no loss •  Firefox and Chrome don’t always behave the same
PLR in the real world
Some reading… •  http://c3lab.poliba.it/images/3/3b/QUIC_SAC15.pdf •  https://www.usenix.org/system/files/conference/nsdi14/nsdi14-paper- wang_xiao_sophia.pdf •  http://arxiv.org/pdf/1507.06562v1.pdf •  http://nl.cs.montana.edu/lab/publications/Goel_H2_extended.pdf •  https://99designs.com.au/tech-blog/blog/2016/07/14/real-world- http-2-400gb-of-images-per-day/
Now what?
Caution! •  we’re not going to draw big conclusions, other than: –  Packet loss seems to matter –  h2 isn’t always faster! •  This was all simulated –  PLR is different in the real world –  Users have a mix of connection profiles –  Nothing beats real world data •  Your mileage may (and will) vary
Don’t listen to anyone!!
Don’t listen to anyone!!
https://speakerdeck.com/patrickhamann/http2-what-where-why-and-when-smashing-conference-march-2016
https://speakerdeck.com/patrickhamann/http2-what-where-why-and-when-smashing-conference-march-2016
https://github.com/fastlyhoo/wpt_h1vsh2
https://github.com/fastlyhoo/wpt_h1vsh2
QUIC
Server push
Server push basics •  Ability to “push” a resource to the client before the client requests it –  And before the client knows it needs it –  Only servers can push •  Hop-by-hop
SETTINGS
PUSH_PROMISE
connection HEADERS (sid=1) GET /index.html time DATA (sid=2) DATA (sid=1) DATA (sid=2) DATA (sid=2) DATA (sid=2)HEADERS (sid=2) PUSH_PROMISE(sid=1) Promised sid=2 GET /css1.css <request headers> DATA (sid=1) DATA (sid=1) DATA (sid=1)HEADERS (sid=1)
Server Push •  What do we push? –  Outside the scope of the protocol •  Push and browser caches don’t necessarily play well together –  RST_STREAM ? –  Even if the browser rejected, it’s too late
No push – first view
No push – repeat view
Push – first view Pushed
Push – repeat view Pushed
Use cases
Essential resources for this page •  Similar to <Link rel=“preload”> •  Save 1xRTT
Push: No Push:
Push during server think time •  Push assets to the browser while the server is “thinking” –  Backend processing –  Time to deliver HTML from origin through a CDN
Push during server think time •  Push assets to the browser while the server is “thinking” –  Backend processing –  Time to deliver HTML from origin through a CDN •  https://blog.yoav.ws/being_pushy/ •  This isn’t a trivial thing to do; ask your CDN about support
Next navigation? h$ps://w3c.github.io/resource-hints/
We still have some questions •  What do we push? –  Still unclear… –  https://docs.google.com/document/d/ 1K0NykTXBbbbTlv60t5MyJvXjqKGsCVNYHyLEXIxYMv0/ edit •  What if it’s already in the browser cache? –  H2O: CASPER –  Cache Digests: •  https://tools.ietf.org/html/draft-ietf-httpbis-cache-digest-00
Other use cases? h$ps://www.facebook.com/atscaleevents/videos/1775942979345465/
HPACK
HPACK (RFC 7541) •  Addresses the header bloat problem •  Two primary mechanisms –  All headers (name=value) are Huffman encoded –  Indexed tables at each peer
Tables •  Static table –  Defined by the RFC, never changes •  Dynamic table –  Built during the connection and maintained by each side –  FIFO
+-------+-----------------------------+---------------+ | Index | Header Name | Header Value | +-------+-----------------------------+---------------+ | 1 | :authority | | | 2 | :method | GET | | 3 | :method | POST | | 4 | :path | / | | 5 | :path | /index.html | | 6 | :scheme | http | | 7 | :scheme | https | | 8 | :status | 200 | | 9 | :status | 204 | | 10 | :status | 206 | | 11 | :status | 304 | | 12 | :status | 400 | | 13 | :status | 404 | | 14 | :status | 500 | | 15 | accept-charset | | | 16 | accept-encoding | gzip, deflate | | 17 | accept-language | | | 18 | accept-ranges | | | 19 | accept | | | 20 | access-control-allow-origin | | | 21 | age | | | 22 | allow | | | 23 | authorization | | | 24 | cache-control | | | 25 | content-disposition | | | 26 | content-encoding | | | 27 | content-language | | | 28 | content-length | | | 29 | content-location | | | 30 | content-range | | +-------+-----------------------------+---------------+ Table 1: Static Table Entries +-------+-----------------------------+---------------+ | Index | Header Name | Header Value | +-------+-----------------------------+---------------+ | 31 | content-type | | | 32 | cookie | | | 33 | date | | | 34 | etag | | | 35 | expect | | | 36 | expires | | | 37 | from | | | 38 | host | | | 39 | if-match | | | 40 | if-modified-since | | | 41 | if-none-match | | | 42 | if-range | | | 43 | if-unmodified-since | | | 44 | last-modified | | | 45 | link | | | 46 | location | | | 47 | max-forwards | | | 48 | proxy-authenticate | | | 49 | proxy-authorization | | | 50 | range | | | 51 | referer | | | 52 | refresh | | | 53 | retry-after | | | 54 | server | | | 55 | set-cookie | | | 56 | strict-transport-security | | | 57 | transfer-encoding | | | 58 | user-agent | | | 59 | vary | | | 60 | via | | | 61 | www-authenticate | | +-------+-----------------------------+---------------+ Table 1: Static Table Entries
Performance benefits
Performance benefits Bytes BrowseràServer
Performance benefits Bytes BrowseràServer Bytes BrowseràServer
https://blogs.dropbox.com/tech/2016/05/enabling-http2-for-dropbox-web-services-experiences-and-observations/
HPACK – things to know •  Default size is 4K –  For the entire dynamic table –  Site-wide headers proposal: •  https://tools.ietf.org/html/draft-nottingham-site-wide-headers-00 •  Compression context is set per connection –  New connection starts from scratch with static table and builds new dynamic table •  An attack vector –  https://www.imperva.com/docs/Imperva_HII_HTTP2.pdf •  Can’t turn it off –  Without it, pipelining would be very difficult
content-security-policy: script-src https://connect.facebook.net https://cm.g.doubleclick.net https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com https://api.twitter.com https://analytics.twitter.com https:// publish.twitter.com https://ton.twitter.com 'unsafe-inline' https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com https://www.google- analytics.com 'self'; font-src https://twitter.com https://*.twimg.com data: https:// ton.twitter.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https:// netdna.bootstrapcdn.com 'self'; media-src https://twitter.com https://*.twimg.com https:// ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com https://*.twimg.com https://api.twitter.com https://pay.twitter.com https:// analytics.twitter.com https://media.riffsy.com https://upload.twitter.com https:// api.mapbox.com 'self'; style-src https://fonts.googleapis.com https://twitter.com https:// *.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline' https:// platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com https://pbs.twimg.com; default-src 'self'; frame-src https:// staticxx.facebook.com https://twitter.com https://*.twimg.com https:// 5415703.fls.doubleclick.net https://player.vimeo.com https://pay.twitter.com https:// www.facebook.com https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com 'self' https://donate.twitter.com; img-src https:// graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com data: https:// lumiere-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net https://www.facebook.com https:// ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com https://stats.g.doubleclick.net https://*.tiles.mapbox.com https:// www.google-analytics.com blob: 'self'; report-uri https://twitter.com/i/csp_report? a=NVQWGYLXFVZXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false;
content-security-policy: script-src https://connect.facebook.net https://cm.g.doubleclick.net https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com https://api.twitter.com https://analytics.twitter.com https:// publish.twitter.com https://ton.twitter.com 'unsafe-inline' https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com https://www.google- analytics.com 'self'; font-src https://twitter.com https://*.twimg.com data: https:// ton.twitter.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https:// netdna.bootstrapcdn.com 'self'; media-src https://twitter.com https://*.twimg.com https:// ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com https://*.twimg.com https://api.twitter.com https://pay.twitter.com https:// analytics.twitter.com https://media.riffsy.com https://upload.twitter.com https:// api.mapbox.com 'self'; style-src https://fonts.googleapis.com https://twitter.com https:// *.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline' https:// platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com https://pbs.twimg.com; default-src 'self'; frame-src https:// staticxx.facebook.com https://twitter.com https://*.twimg.com https:// 5415703.fls.doubleclick.net https://player.vimeo.com https://pay.twitter.com https:// www.facebook.com https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com 'self' https://donate.twitter.com; img-src https:// graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com data: https:// lumiere-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net https://www.facebook.com https:// ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com https://stats.g.doubleclick.net https://*.tiles.mapbox.com https:// www.google-analytics.com blob: 'self'; report-uri https://twitter.com/i/csp_report? a=NVQWGYLXFVZXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false; 2.2KB
HPACK – things to know •  Default size is 4K –  For the entire dynamic table –  Site-wide headers proposal: •  https://tools.ietf.org/html/draft-nottingham-site-wide-headers-00 •  Compression context is set per connection –  New connection starts from scratch with static table and builds new dynamic table •  An attack vector –  https://www.imperva.com/docs/Imperva_HII_HTTP2.pdf •  Can’t turn it off –  Without it, pipelining would be very difficult
Tools and resources
http://chimera.labs.oreilly.com/books/1230000000545
HTTP/2 and SPDY indicator •  Chrome: –  https://chrome.google.com/webstore/detail/http2-and-spdy- indicator/mpbpobfflnpcgagjijhmgnchggcjblin?hl=en •  Firefox: –  https://addons.mozilla.org/en-us/firefox/addon/spdy-indicator/
Chrome DevTools
Chrome net-internals
wireshark Using the TLS key file: h$ps://jimshaver.net/2015/02/11/decrypMng-tls-browser-traffic-with-wireshark-the-easy-way/
cURL
https://nghttp2.org/ nghttp
Others •  h2c (and wiretapping): –  https://github.com/fstab/h2c •  h2a: reverse proxy –  https://github.com/summerwind/h2a •  Conformance: –  https://github.com/summerwind/h2spec •  Charles proxy –  https://www.charlesproxy.com •  http-wg –  https://github.com/http2/http2-spec/wiki/Tools
Summary and takeaways •  h2 is complicated, but hopefully better for us going forward –  Browser protocol? •  Not everything will be as easy/fast as we’d like •  We still have a lot of learning to do •  We need to start thinking about how to build applications to best leverage the new protocol •  You can help!
Thank you!

More Related Content

PDF
Spotify: P2P music-on-demand streaming
byRicardo Vice Santos
 
PDF
Developing the fastest HTTP/2 server
byKazuho Oku
 
PDF
How happy they became with H2O/mruby and the future of HTTP
byIchito Nagata
 
PPTX
Inside Zalo: Developing a mobile messenger for the audience of millions
byPandora.VN
 
PPTX
Building your First gRPC Service
byJessie Barnett
 
PPTX
High Performance and Scalability Database Design
byTung Ns
 
PDF
H2O - the optimized HTTP server
byKazuho Oku
 
PDF
gRPC Design and Implementation
byVarun Talwar
 
Spotify: P2P music-on-demand streaming
byRicardo Vice Santos
 
Developing the fastest HTTP/2 server
byKazuho Oku
 
How happy they became with H2O/mruby and the future of HTTP
byIchito Nagata
 
Inside Zalo: Developing a mobile messenger for the audience of millions
byPandora.VN
 
Building your First gRPC Service
byJessie Barnett
 
High Performance and Scalability Database Design
byTung Ns
 
H2O - the optimized HTTP server
byKazuho Oku
 
gRPC Design and Implementation
byVarun Talwar
 

What's hot

PPTX
HTTP2 and gRPC
byGuo Jing
 
PDF
How to get AWS student credit
byJungwon Seo
 
PPTX
Thrift vs Protocol Buffers vs Avro - Biased Comparison
byIgor Anishchenko
 
PDF
Linux Servers
byRanjith Siji
 
PDF
Building microservices with grpc
bySathiyaseelan Muthu kumar
 
PDF
Monitoring Hadoop with Prometheus (Hadoop User Group Ireland, December 2015)
byBrian Brazil
 
PDF
Sơ lược kiến trúc hệ thống Zing Me
byzingopen
 
PDF
gRPC and Microservices
byJonathan Gomez
 
PDF
Producer Performance Tuning for Apache Kafka
byJiangjie Qin
 
PDF
Upgrading HDFS to 3.3.0 and deploying RBF in production #LINE_DM
byYahoo!デベロッパーネットワーク
 
PDF
An Abusive Relationship with AngularJS
byMario Heiderich
 
PDF
NETCONF Call Home
byADVA
 
PDF
JSON WEB TOKEN
byKnoldus Inc.
 
PPTX
Introduction to gRPC
byChandresh Pancholi
 
PPTX
Tiki.vn - How we scale as a tech startup
byTung Ns
 
PPTX
Grokking Techtalk #40: Consistency and Availability tradeoff in database cluster
byGrokking VN
 
PPTX
Google File System
byAmgad Muhammad
 
PPTX
TRex Realistic Traffic Generator - Stateless support
byHanoch Haim
 
PDF
Prometheus
bywyukawa
 
PPTX
John the ripper & hydra password cracking tool
byMd. Raquibul Hoque
 
HTTP2 and gRPC
byGuo Jing
 
How to get AWS student credit
byJungwon Seo
 
Thrift vs Protocol Buffers vs Avro - Biased Comparison
byIgor Anishchenko
 
Linux Servers
byRanjith Siji
 
Building microservices with grpc
bySathiyaseelan Muthu kumar
 
Monitoring Hadoop with Prometheus (Hadoop User Group Ireland, December 2015)
byBrian Brazil
 
Sơ lược kiến trúc hệ thống Zing Me
byzingopen
 
gRPC and Microservices
byJonathan Gomez
 
Producer Performance Tuning for Apache Kafka
byJiangjie Qin
 
Upgrading HDFS to 3.3.0 and deploying RBF in production #LINE_DM
byYahoo!デベロッパーネットワーク
 
An Abusive Relationship with AngularJS
byMario Heiderich
 
NETCONF Call Home
byADVA
 
JSON WEB TOKEN
byKnoldus Inc.
 
Introduction to gRPC
byChandresh Pancholi
 
Tiki.vn - How we scale as a tech startup
byTung Ns
 
Grokking Techtalk #40: Consistency and Availability tradeoff in database cluster
byGrokking VN
 
Google File System
byAmgad Muhammad
 
TRex Realistic Traffic Generator - Stateless support
byHanoch Haim
 
Prometheus
bywyukawa
 
John the ripper & hydra password cracking tool
byMd. Raquibul Hoque
 

Viewers also liked

PPTX
HTTP/2 Changes Everything
byLori MacVittie
 
PDF
Advanced VCL: how to use restart
byFastly
 
PPTX
Solving anything in VCL
byFastly
 
PDF
Http2
byDaniel Stenberg
 
PDF
Real world experiences with HTTP/2 (Michael Gooding, Javier Garza from Akamai)
by💻 Javier Garza
 
PDF
Incident Command: The far side of the edge
byFastly
 
PDF
Principles of Globally Distributed Systems
byFastly
 
PPTX
HTTP/2 Introduction
byWalter Liu
 
PPTX
Introducing HTTP/2
byIdo Flatow
 
PDF
Http2 right now
byDaniel Stenberg
 
PPTX
What's New in HTTP/2
byNGINX, Inc.
 
PPTX
Http/2
byAdrian Cardenas
 
PDF
The Case for HTTP/2
byAndy Davies
 
PDF
Next-gen API authentication
byFastly
 
PDF
Addressing IPv6
byFastly
 
PDF
Inside election night at The New York Times | Altitude NYC
byFastly
 
PDF
Building Customer User Experiences from the Edge
byFastly
 
PDF
Know your resolvers
byFastly
 
PDF
Living room sessions: war stories | Altitude NYC
byFastly
 
PDF
Why we fight | Altitude NYC
byFastly
 
HTTP/2 Changes Everything
byLori MacVittie
 
Advanced VCL: how to use restart
byFastly
 
Solving anything in VCL
byFastly
 
Http2
byDaniel Stenberg
 
Real world experiences with HTTP/2 (Michael Gooding, Javier Garza from Akamai)
by💻 Javier Garza
 
Incident Command: The far side of the edge
byFastly
 
Principles of Globally Distributed Systems
byFastly
 
HTTP/2 Introduction
byWalter Liu
 
Introducing HTTP/2
byIdo Flatow
 
Http2 right now
byDaniel Stenberg
 
What's New in HTTP/2
byNGINX, Inc.
 
Http/2
byAdrian Cardenas
 
The Case for HTTP/2
byAndy Davies
 
Next-gen API authentication
byFastly
 
Addressing IPv6
byFastly
 
Inside election night at The New York Times | Altitude NYC
byFastly
 
Building Customer User Experiences from the Edge
byFastly
 
Know your resolvers
byFastly
 
Living room sessions: war stories | Altitude NYC
byFastly
 
Why we fight | Altitude NYC
byFastly
 

Similar to HTTP/2: What no one is telling you

PDF
Revisiting HTTP/2
byFastly
 
PDF
HTTP/2で 速くなるとき ならないとき
byKazuho Oku
 
PPTX
HTTP
byaltaykarakus
 
PPTX
Http/2
byGeekNightHyderabad
 
PDF
What HTTP/2.0 Will Do For You
byMark Nottingham
 
PPT
A detailed presentation on the World Wide Web
byG.B. Pant University of Agriculture and Technology
 
PPT
www | HTTP | HTML - Tutorial
byMSA Technosoft
 
PDF
Unit v
byAPARNA P
 
PDF
Revisiting HTTP/2
byFastly
 
PDF
Improving performance by changing the rules from fast to SPDY
byCotendo
 
PDF
From Fast To SPDY
byMike Belshe
 
PDF
SPDY & HTTP2.0 & QUIC - #bpstudy 2013-08-28
byJxck Jxck
 
PPTX
Http2 Security Perspective
bySunil Kumar
 
PPTX
F5 EMEA Webinar Oct'15: http2 how to ease the transition
byDmitry Tikhovich
 
PDF
Http:2.0 101 introduction (workshop) - Bastian Hofmann
byUNICORNS IN TECH
 
PDF
University of Delaware - Improving Web Protocols (early SPDY talk)
byMike Belshe
 
PPT
internet applications
bySrinivasa Rao
 
PDF
Application layer
byMohamed Sajith
 
PDF
Web Architectures - Web Technologies (1019888BNR)
byBeat Signer
 
PDF
Web Architectures - Lecture 02 - Web Information Systems (4011474FNR)
byBeat Signer
 
Revisiting HTTP/2
byFastly
 
HTTP/2で 速くなるとき ならないとき
byKazuho Oku
 
HTTP
byaltaykarakus
 
Http/2
byGeekNightHyderabad
 
What HTTP/2.0 Will Do For You
byMark Nottingham
 
A detailed presentation on the World Wide Web
byG.B. Pant University of Agriculture and Technology
 
www | HTTP | HTML - Tutorial
byMSA Technosoft
 
Unit v
byAPARNA P
 
Revisiting HTTP/2
byFastly
 
Improving performance by changing the rules from fast to SPDY
byCotendo
 
From Fast To SPDY
byMike Belshe
 
SPDY & HTTP2.0 & QUIC - #bpstudy 2013-08-28
byJxck Jxck
 
Http2 Security Perspective
bySunil Kumar
 
F5 EMEA Webinar Oct'15: http2 how to ease the transition
byDmitry Tikhovich
 
Http:2.0 101 introduction (workshop) - Bastian Hofmann
byUNICORNS IN TECH
 
University of Delaware - Improving Web Protocols (early SPDY talk)
byMike Belshe
 
internet applications
bySrinivasa Rao
 
Application layer
byMohamed Sajith
 
Web Architectures - Web Technologies (1019888BNR)
byBeat Signer
 
Web Architectures - Lecture 02 - Web Information Systems (4011474FNR)
byBeat Signer
 

More from Fastly

PPTX
Altitude San Francisco 2018: Testing with Fastly Workshop
byFastly
 
PPTX
Altitude San Francisco 2018: Building the Souther Hemisphere of the Internet
byFastly
 
PDF
Enabling lightning fast content delivery for Spotify
byFastly
 
PDF
Altitude San Francisco 2018: Scale and Stability at the Edge with 1.4 Billion...
byFastly
 
PDF
Altitude San Francisco 2018: Fastly Purge Control at the USA TODAY NETWORK
byFastly
 
PDF
Altitude San Francisco 2018: HTTP/2 Tales: Discovery and Woe
byFastly
 
PPTX
Altitude San Francisco 2018: Video Workshop Docs
byFastly
 
PPTX
Altitude San Francisco 2018: Programming the Edge
byFastly
 
PPTX
Altitude San Francisco 2018: WAF Workshop
byFastly
 
PDF
Altitude San Francisco 2018: We Own Our Destiny
byFastly
 
PPTX
Altitude San Francisco 2018: Logging at the Edge
byFastly
 
PDF
Altitude San Francisco 2018: Bringing TLS to GitHub Pages
byFastly
 
PDF
Altitude San Francisco 2018: HTTP Invalidation Workshop
byFastly
 
PPTX
Altitude San Francisco 2018: Preparing for Video Streaming Events at Scale
byFastly
 
PPTX
Altitude San Francisco 2018: Authentication at the Edge
byFastly
 
PPTX
Altitude San Francisco 2018: How Magento moved to the cloud while maintaining...
byFastly
 
PDF
Altitude San Francisco 2018: Moving Off the Monolith: A Seamless Migration
byFastly
 
PDF
Altitude San Francisco 2018: Scaling Ethereum to 10B requests per day
byFastly
 
PDF
Altitude San Francisco 2018: WebAssembly Tools & Applications
byFastly
 
PDF
Altitude San Francisco 2018: The World Cup Stream
byFastly
 
Altitude San Francisco 2018: Testing with Fastly Workshop
byFastly
 
Altitude San Francisco 2018: Building the Souther Hemisphere of the Internet
byFastly
 
Enabling lightning fast content delivery for Spotify
byFastly
 
Altitude San Francisco 2018: Scale and Stability at the Edge with 1.4 Billion...
byFastly
 
Altitude San Francisco 2018: Fastly Purge Control at the USA TODAY NETWORK
byFastly
 
Altitude San Francisco 2018: HTTP/2 Tales: Discovery and Woe
byFastly
 
Altitude San Francisco 2018: Video Workshop Docs
byFastly
 
Altitude San Francisco 2018: Programming the Edge
byFastly
 
Altitude San Francisco 2018: WAF Workshop
byFastly
 
Altitude San Francisco 2018: We Own Our Destiny
byFastly
 
Altitude San Francisco 2018: Logging at the Edge
byFastly
 
Altitude San Francisco 2018: Bringing TLS to GitHub Pages
byFastly
 
Altitude San Francisco 2018: HTTP Invalidation Workshop
byFastly
 
Altitude San Francisco 2018: Preparing for Video Streaming Events at Scale
byFastly
 
Altitude San Francisco 2018: Authentication at the Edge
byFastly
 
Altitude San Francisco 2018: How Magento moved to the cloud while maintaining...
byFastly
 
Altitude San Francisco 2018: Moving Off the Monolith: A Seamless Migration
byFastly
 
Altitude San Francisco 2018: Scaling Ethereum to 10B requests per day
byFastly
 
Altitude San Francisco 2018: WebAssembly Tools & Applications
byFastly
 
Altitude San Francisco 2018: The World Cup Stream
byFastly
 

Recently uploaded

PPTX
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
PDF
5G Explained! A High Level Overview [Introduction]
byLuciano Motta
 
PPTX
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 
PDF
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
PDF
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
PPTX
Dell poweredge-customer-presentation.pptx
byhungungphu123
 
PPTX
6G and Non-Terrestrial Networks (NTN) Testing.pptx
byXRComm
 
PDF
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
PPTX
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
PDF
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
PPTX
AI in Marine Insurance Future of Smarter Risk, Faster Claims & Safer Shipping...
byAutomationEdge Technologies
 
PDF
How to Design Premium Health (Public Health) PPT Using AI? Top Strategies
byPublic Health Concern Nepal
 
PPT
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
PDF
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
PDF
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
PDF
Transcript: What ONIX can do: Leveraging metadata to support the discoverabil...
byBookNet Canada
 
PPTX
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
PPTX
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
PPTX
Understanding-Search-Algorithms_09-12-25.pptx
byshaikmahammedtauheed
 
PPTX
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 
Storage-and-HCI-Positioning-update-sales.pptx
byhungungphu123
 
5G Explained! A High Level Overview [Introduction]
byLuciano Motta
 
Achieve enterprise automation with SAP BTP solutions and SAP Signavio
bydarrellkiwi
 
Why Are Cloud Migration Services Essential for Modern Business Growth?
byGeoPITS Global Pvt Ltd
 
Teaching Robots how to Read 1/2: AI Center & Classic Document Understanding (...
byanabulhac
 
Dell poweredge-customer-presentation.pptx
byhungungphu123
 
6G and Non-Terrestrial Networks (NTN) Testing.pptx
byXRComm
 
Skills to Pass the UiPath Agentic Automation Associate (UiAAA) Certification
byUiPathCommunity
 
Advance Computer Architecture Lecture 4.pptx
byBottshikanBottshikan
 
How the EU Ecolabel's Record Growth Creates ESG Opportunities for CRE
byWastify AI
 
AI in Marine Insurance Future of Smarter Risk, Faster Claims & Safer Shipping...
byAutomationEdge Technologies
 
How to Design Premium Health (Public Health) PPT Using AI? Top Strategies
byPublic Health Concern Nepal
 
Database Management Systems: Basics, History, Data Models, etc.
byParithi Thamizh
 
Computer Science Conferences 2026 | Research by SAI Conference
byHealth Conference 2026
 
Ethical AI applied to publishing: Presenting wâsikan kisewâtisiwin, an AI too...
byBookNet Canada
 
Transcript: What ONIX can do: Leveraging metadata to support the discoverabil...
byBookNet Canada
 
SOFTWARE DEVELOPMENT PROCESS - INTRODUCTION
byParithi Thamizh
 
Strategic Shelf Planning for the New Year Turning Resolutions into Revenue .pptx
byAnoop Ashok
 
Understanding-Search-Algorithms_09-12-25.pptx
byshaikmahammedtauheed
 
Single Cell Protein from Methane or Methanol - Process development research c...
byJohn Downs
 

HTTP/2: What no one is telling you

  • 1.
  • 2.
    some people are startingto tell you! Hooman Beheshti VP Technology HTTP/2: What no one’s telling you
  • 3.
    Everything will be muchfaster! You don’t need to change anything! Google said so! You can stop doing optimizations!
  • 4.
  • 5.
    Goals •  Take anobjective look at the protocol •  Practical considerations •  Share data •  Better understand the good –  And the bad?
  • 6.
  • 7.
  • 8.
  • 9.
  • 10.
    A single connection • single, long-lasting TCP connection •  Theoretically, this means better congestion management between peers •  TLS (with ALPN) •  Connection reuse across domains (same IP and cert)
  • 11.
  • 12.
  • 13.
    Streams •  Virtual channelsfor communication –  Translate roughly to a request/response exchange –  Client or server can initiate or terminate •  Stream IDs: –  Client: odd; server: even; 0: reserved –  Each ID has to be larger than the ones before it initiated by the endpoint –  Cannot be reused
  • 14.
  • 15.
    connection stream stream stream … frame frame frameframe frame frame frame frame frame frame frame frame frame frame frame frame frame frame frame
  • 16.
    GET /thing HTTP/1.1 Host:www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html Request Response
  • 17.
    GET /thing HTTP/1.1 Host:www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html HEADERS Request Response
  • 18.
    GET /thing HTTP/1.1 Host:www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html HEADERS HEADERS Request Response
  • 19.
    GET /thing HTTP/1.1 Host:www.example.com User-Agent: Some_user_agent HTTP/1.1 200 OK Server: some_server Content-Type: text/html Content-Length: 1000 html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html html DATA DATA DATA DATA DATA DATA HEADERS HEADERS Request Response
  • 20.
    DATA Carries requestor response data HEADERS Carries request/response headers/trailers; can initiate a stream PRIORITY Indicates priority of a stream RST_STREAM Terminates a stream SETTINGS Defines parameters for the connection only PUSH_PROMISE Signals peer for server push PING Maintenance frame for checking RTT, connection, etc GOAWAY For shutting down a connection WINDOW_UPDATE Frame responsible for flow control adjustments CONTINUATION Extends a HEADERS frame and can carry more headers
  • 21.
    DATA Carries requestor response data HEADERS Carries request/response headers/trailers; can initiate a stream PRIORITY Indicates priority of a stream RST_STREAM Terminates a stream SETTINGS Defines parameters for the connection only PUSH_PROMISE Signals peer for server push PING Maintenance frame for checking RTT, connection, etc GOAWAY For shutting down a connection WINDOW_UPDATE Frame responsible for flow control adjustments CONTINUATION Extends a HEADERS frame and can carry more headers
  • 22.
  • 23.
  • 24.
  • 25.
  • 26.
  • 27.
  • 29.
  • 30.
  • 32.
  • 33.
    Servers •  Apache &Nginx •  h2o –  https://h2o.examp1e.net/ •  https://en.wikipedia.org/wiki/HTTP/2 •  Talk to your CDNs
  • 34.
  • 35.
  • 38.
    Private WebpageTest 5Mbps/1Mbps; 40mslatency Chrome; h1 vs h2
  • 39.
    Private WebpageTest 5Mbps/1Mbps; 40mslatency Chrome; h1 vs h2 ~270 runs each!!
  • 41.
  • 48.
  • 50.
  • 51.
    Firefox; Slow 3G:780Kbps/330Kbps, 200ms latency
  • 52.
  • 53.
  • 54.
          0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms DocComplete h2 h2 h2 h2 h1 h1 h1 h1 Keeping score…
  • 55.
          0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms DocComplete h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1 h2 h1 h1 h1 h2 h1 Speed Index h2/h1 h2 h2 h2 h1 h1 h2 h2 Keeping score…
  • 56.
  • 61.
    Head of lineblocking in TCP
  • 64.
  • 65.
    Real pages •  8pages (from 8 real sites) •  16 bandwidth/latency combinations –  Each with 0%, 0.5%, 1%, 2% PLR •  Firefox and Chrome, TLS only, collect all metrics •  300-400 runs with each combination
  • 66.
    Real pages •  8pages (from 8 real sites) •  16 bandwidth/latency combinations –  Each with 0%, 0.5%, 1%, 2% PLR •  Firefox and Chrome, TLS only, collect all metrics •  300-400 runs with each combination
  • 68.
    Analysis •  3 Typesof pages, # of resources h1àh2: –  ~75% or higher –  ~half –  ~25% or lower •  2 profiles (0%, 0.5%, 1%, 2% PLR): –  “Broadband”: 5Mbps/1Mbps/40ms –  “Slow 3G”: 780Kbps/330Kbps/200ms •  3 Metrics –  Document Complete –  DOM Content Loaded Start –  Speed Index
  • 69.
    Site1: Fastly customerspage 130-135 requests to onload (~3MB) ~99 requests h1àh2 (2.5MB)
  • 71.
  • 72.
  • 73.
    Site1; Speed Index;5Mbps/1Mbps/40ms
  • 74.
  • 75.
  • 76.
    Site1; Speed Index;780Kbps/330Kbps/200ms
  • 77.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2
  • 78.
    Site2 90-100 requests toonload (~1.7MB) ~47 requests h1àh2 (1.2MB)
  • 80.
  • 81.
  • 82.
    Site2; Speed Index;5Mbps/1Mbps/40ms
  • 83.
  • 84.
  • 85.
    Site2; Speed Index;780Kbps/330Kbps/200ms ***
  • 86.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2       Site2 DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2
  • 87.
    Site3 176-212 requests toonload (~3.5MB) ~45-55 requests h1àh2 (2MB)
  • 89.
  • 90.
  • 91.
    Site3; Speed Index;5Mbps/1Mbps/40ms
  • 92.
  • 93.
  • 94.
    Site3; Speed Index;780Kbps/330Kbps/200ms
  • 95.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1 (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2       Site2 DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2       Site3 DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1
  • 96.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
  • 97.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
  • 98.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
  • 99.
    0% PLR 2%PLR 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms 5Mbps/1Mbps; 40ms 780Kbps/330Kbps; 200ms Site1a (Fastly) DocComplete h2 h2 h2 h1 h1 h1 h1 h1 DCL Start h2 h1 h2 h2 h2/h1 h1 h2 h2 Speed Index h1 h2 h2 h2 h1 h2/h1 h2/h1 h2 Site1b DocComplete h2/h1 h2 h2 h2 h1 h2 h1 h2/h1 DCL Start h1 h2 h1 h1 h1 h2/h1 h1 h1 Speed Index h1 h2 h2 h1 h1 h2/h1 h1 h1 Site1c DocComplete h1/h2 h2 h2 h2 h1 h1 h1 h1 DCL Start h1 h1/h2 h1 h1 h1 h2 h1 h1 Speed Index h2 h2 h1 h2 h1 h2 h1 h1 Site2a DocComplete h2 h2 h2 h2 h1 h2/h1 h1 h1 DCL Start h2 h2 h2 h2 h1 h1 h1 h1 Speed Index h1 h2 h1 h2 h1 h2 h1 h2 Site2b DocComplete h2 h2 h2 h2 h1 h1/h2 h1 h1 DCL Start h2 h2 h1 h2 h1 h2 h1 h2 Speed Index h2 h1/h2 h1 h1/h2 h2 h2 h1 h1 Site3a DocComplete h2 h2 h1 h2 h2 h2 h1 h1 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h2 h2 h1 h1 h1/h2 h1/h2 h1 h1 Site3b DocComplete h2 h2 h2 h1/h2 h2 h2/h1 h2 h2 DCL Start h2 h2 h2 h2 h2 h2 h2 h2 Speed Index h1 h2 h1 h1 h1 h2 h1 h1 Site3c DocComplete h1 h2 h2 h2 h1 h2 h2 h2 DCL Start h1/h2 h2 h1 h1/h2 h2/h1 h2 h1 h2/h1 Speed Index h1 h2 h2 h2 h2 h2 h2 h2
  • 100.
    Trends? •  Metrics laterin the page seem to get affected more by packet loss (?) •  Lots of exceptions –  Sometimes h2 holds up even under loss conditions –  Sometimes h1 wins even when there’s no loss •  Firefox and Chrome don’t always behave the same
  • 101.
    PLR in thereal world
  • 103.
    Some reading… •  http://c3lab.poliba.it/images/3/3b/QUIC_SAC15.pdf • https://www.usenix.org/system/files/conference/nsdi14/nsdi14-paper- wang_xiao_sophia.pdf •  http://arxiv.org/pdf/1507.06562v1.pdf •  http://nl.cs.montana.edu/lab/publications/Goel_H2_extended.pdf •  https://99designs.com.au/tech-blog/blog/2016/07/14/real-world- http-2-400gb-of-images-per-day/
  • 104.
  • 105.
    Caution! •  we’re notgoing to draw big conclusions, other than: –  Packet loss seems to matter –  h2 isn’t always faster! •  This was all simulated –  PLR is different in the real world –  Users have a mix of connection profiles –  Nothing beats real world data •  Your mileage may (and will) vary
  • 106.
  • 107.
  • 108.
  • 109.
  • 110.
  • 111.
  • 112.
  • 114.
  • 115.
    Server push basics • Ability to “push” a resource to the client before the client requests it –  And before the client knows it needs it –  Only servers can push •  Hop-by-hop
  • 116.
  • 117.
  • 118.
    connection HEADERS (sid=1) GET /index.html time DATA(sid=2) DATA (sid=1) DATA (sid=2) DATA (sid=2) DATA (sid=2)HEADERS (sid=2) PUSH_PROMISE(sid=1) Promised sid=2 GET /css1.css <request headers> DATA (sid=1) DATA (sid=1) DATA (sid=1)HEADERS (sid=1)
  • 121.
    Server Push •  Whatdo we push? –  Outside the scope of the protocol •  Push and browser caches don’t necessarily play well together –  RST_STREAM ? –  Even if the browser rejected, it’s too late
  • 122.
    No push –first view
  • 123.
    No push –repeat view
  • 124.
    Push – firstview Pushed
  • 125.
    Push – repeatview Pushed
  • 126.
  • 127.
    Essential resources forthis page •  Similar to <Link rel=“preload”> •  Save 1xRTT
  • 128.
  • 129.
    Push during serverthink time •  Push assets to the browser while the server is “thinking” –  Backend processing –  Time to deliver HTML from origin through a CDN
  • 131.
    Push during serverthink time •  Push assets to the browser while the server is “thinking” –  Backend processing –  Time to deliver HTML from origin through a CDN •  https://blog.yoav.ws/being_pushy/ •  This isn’t a trivial thing to do; ask your CDN about support
  • 132.
  • 133.
    We still havesome questions •  What do we push? –  Still unclear… –  https://docs.google.com/document/d/ 1K0NykTXBbbbTlv60t5MyJvXjqKGsCVNYHyLEXIxYMv0/ edit •  What if it’s already in the browser cache? –  H2O: CASPER –  Cache Digests: •  https://tools.ietf.org/html/draft-ietf-httpbis-cache-digest-00
  • 134.
  • 135.
  • 136.
    HPACK (RFC 7541) • Addresses the header bloat problem •  Two primary mechanisms –  All headers (name=value) are Huffman encoded –  Indexed tables at each peer
  • 137.
    Tables •  Static table – Defined by the RFC, never changes •  Dynamic table –  Built during the connection and maintained by each side –  FIFO
  • 138.
    +-------+-----------------------------+---------------+ | Index |Header Name | Header Value | +-------+-----------------------------+---------------+ | 1 | :authority | | | 2 | :method | GET | | 3 | :method | POST | | 4 | :path | / | | 5 | :path | /index.html | | 6 | :scheme | http | | 7 | :scheme | https | | 8 | :status | 200 | | 9 | :status | 204 | | 10 | :status | 206 | | 11 | :status | 304 | | 12 | :status | 400 | | 13 | :status | 404 | | 14 | :status | 500 | | 15 | accept-charset | | | 16 | accept-encoding | gzip, deflate | | 17 | accept-language | | | 18 | accept-ranges | | | 19 | accept | | | 20 | access-control-allow-origin | | | 21 | age | | | 22 | allow | | | 23 | authorization | | | 24 | cache-control | | | 25 | content-disposition | | | 26 | content-encoding | | | 27 | content-language | | | 28 | content-length | | | 29 | content-location | | | 30 | content-range | | +-------+-----------------------------+---------------+ Table 1: Static Table Entries +-------+-----------------------------+---------------+ | Index | Header Name | Header Value | +-------+-----------------------------+---------------+ | 31 | content-type | | | 32 | cookie | | | 33 | date | | | 34 | etag | | | 35 | expect | | | 36 | expires | | | 37 | from | | | 38 | host | | | 39 | if-match | | | 40 | if-modified-since | | | 41 | if-none-match | | | 42 | if-range | | | 43 | if-unmodified-since | | | 44 | last-modified | | | 45 | link | | | 46 | location | | | 47 | max-forwards | | | 48 | proxy-authenticate | | | 49 | proxy-authorization | | | 50 | range | | | 51 | referer | | | 52 | refresh | | | 53 | retry-after | | | 54 | server | | | 55 | set-cookie | | | 56 | strict-transport-security | | | 57 | transfer-encoding | | | 58 | user-agent | | | 59 | vary | | | 60 | via | | | 61 | www-authenticate | | +-------+-----------------------------+---------------+ Table 1: Static Table Entries
  • 139.
  • 140.
  • 141.
  • 142.
  • 143.
    HPACK – thingsto know •  Default size is 4K –  For the entire dynamic table –  Site-wide headers proposal: •  https://tools.ietf.org/html/draft-nottingham-site-wide-headers-00 •  Compression context is set per connection –  New connection starts from scratch with static table and builds new dynamic table •  An attack vector –  https://www.imperva.com/docs/Imperva_HII_HTTP2.pdf •  Can’t turn it off –  Without it, pipelining would be very difficult
  • 144.
    content-security-policy: script-src https://connect.facebook.nethttps://cm.g.doubleclick.net https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com https://api.twitter.com https://analytics.twitter.com https:// publish.twitter.com https://ton.twitter.com 'unsafe-inline' https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com https://www.google- analytics.com 'self'; font-src https://twitter.com https://*.twimg.com data: https:// ton.twitter.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https:// netdna.bootstrapcdn.com 'self'; media-src https://twitter.com https://*.twimg.com https:// ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com https://*.twimg.com https://api.twitter.com https://pay.twitter.com https:// analytics.twitter.com https://media.riffsy.com https://upload.twitter.com https:// api.mapbox.com 'self'; style-src https://fonts.googleapis.com https://twitter.com https:// *.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline' https:// platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com https://pbs.twimg.com; default-src 'self'; frame-src https:// staticxx.facebook.com https://twitter.com https://*.twimg.com https:// 5415703.fls.doubleclick.net https://player.vimeo.com https://pay.twitter.com https:// www.facebook.com https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com 'self' https://donate.twitter.com; img-src https:// graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com data: https:// lumiere-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net https://www.facebook.com https:// ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com https://stats.g.doubleclick.net https://*.tiles.mapbox.com https:// www.google-analytics.com blob: 'self'; report-uri https://twitter.com/i/csp_report? a=NVQWGYLXFVZXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false;
  • 145.
    content-security-policy: script-src https://connect.facebook.nethttps://cm.g.doubleclick.net https://ssl.google-analytics.com https://graph.facebook.com https://twitter.com 'unsafe-eval' https://*.twimg.com https://api.twitter.com https://analytics.twitter.com https:// publish.twitter.com https://ton.twitter.com 'unsafe-inline' https://syndication.twitter.com https://www.google.com https://t.tellapart.com https://platform.twitter.com https://www.google- analytics.com 'self'; font-src https://twitter.com https://*.twimg.com data: https:// ton.twitter.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com https:// netdna.bootstrapcdn.com 'self'; media-src https://twitter.com https://*.twimg.com https:// ton.twitter.com blob: 'self'; connect-src https://graph.facebook.com https://*.giphy.com https://*.twimg.com https://api.twitter.com https://pay.twitter.com https:// analytics.twitter.com https://media.riffsy.com https://upload.twitter.com https:// api.mapbox.com 'self'; style-src https://fonts.googleapis.com https://twitter.com https:// *.twimg.com https://translate.googleapis.com https://ton.twitter.com 'unsafe-inline' https:// platform.twitter.com https://maxcdn.bootstrapcdn.com https://netdna.bootstrapcdn.com 'self'; object-src https://twitter.com https://pbs.twimg.com; default-src 'self'; frame-src https:// staticxx.facebook.com https://twitter.com https://*.twimg.com https:// 5415703.fls.doubleclick.net https://player.vimeo.com https://pay.twitter.com https:// www.facebook.com https://ton.twitter.com https://syndication.twitter.com https://vine.co twitter: https://www.youtube.com https://platform.twitter.com https://upload.twitter.com https://s-static.ak.facebook.com 'self' https://donate.twitter.com; img-src https:// graph.facebook.com https://*.giphy.com https://twitter.com https://*.twimg.com data: https:// lumiere-a.akamaihd.net https://fbcdn-profile-a.akamaihd.net https://www.facebook.com https:// ton.twitter.com https://*.fbcdn.net https://syndication.twitter.com https://media.riffsy.com https://www.google.com https://stats.g.doubleclick.net https://*.tiles.mapbox.com https:// www.google-analytics.com blob: 'self'; report-uri https://twitter.com/i/csp_report? a=NVQWGYLXFVZXO2LGOQ%3D%3D%3D%3D%3D%3D&ro=false; 2.2KB
  • 146.
    HPACK – thingsto know •  Default size is 4K –  For the entire dynamic table –  Site-wide headers proposal: •  https://tools.ietf.org/html/draft-nottingham-site-wide-headers-00 •  Compression context is set per connection –  New connection starts from scratch with static table and builds new dynamic table •  An attack vector –  https://www.imperva.com/docs/Imperva_HII_HTTP2.pdf •  Can’t turn it off –  Without it, pipelining would be very difficult
  • 148.
  • 149.
  • 150.
    HTTP/2 and SPDYindicator •  Chrome: –  https://chrome.google.com/webstore/detail/http2-and-spdy- indicator/mpbpobfflnpcgagjijhmgnchggcjblin?hl=en •  Firefox: –  https://addons.mozilla.org/en-us/firefox/addon/spdy-indicator/
  • 151.
  • 152.
  • 153.
  • 154.
  • 155.
  • 156.
    Others •  h2c (andwiretapping): –  https://github.com/fstab/h2c •  h2a: reverse proxy –  https://github.com/summerwind/h2a •  Conformance: –  https://github.com/summerwind/h2spec •  Charles proxy –  https://www.charlesproxy.com •  http-wg –  https://github.com/http2/http2-spec/wiki/Tools
  • 157.
    Summary and takeaways • h2 is complicated, but hopefully better for us going forward –  Browser protocol? •  Not everything will be as easy/fast as we’d like •  We still have a lot of learning to do •  We need to start thinking about how to build applications to best leverage the new protocol •  You can help!
  • 158.