aspnetcore/fundamentals/servers/kestrel/http3.md
:::moniker range=">= aspnetcore-8.0"
HTTP/3 is an approved standard and the third major version of HTTP. This article discusses the requirements for HTTP/3. HTTP/3 is fully supported in .NET 7 or later.
[!IMPORTANT] Apps configured to take advantage of HTTP/3 should be designed to also support HTTP/1.1 and HTTP/2.
HTTP/3:
HTTP/2 while addressing some of its limitations, particularly in terms of performance, latency, reliability, and security.| Feature | HTTP/2 | HTTP/3 |
|---|---|---|
| Transport | Uses TCP | Uses QUIC |
| Connection | Slower due to TCP + TLS | Faster with 0-RTT QUIC |
| Setup | handshake | handshakes |
| Head-of-Line | Affected by TCP-level | Eliminated with QUIC |
| Blocking | blocking | stream multiplexing |
| Encryption | TLS over TCP | TLS is built into QUIC |
The key differences from HTTP/2 to HTTP/3 are:
HTTP/3 uses QUIC instead of TCP. QUIC offers improved performance, lower latency, and better reliability, especially on mobile and lossy networks.HTTP/2 can suffer from head-of-line blocking at the TCP level, where a delay in one stream can affect others. HTTP/3, with QUIC, provides independent streams, so packet loss in one stream doesn't stall others.HTTP/3 with QUIC can establish connections faster, sometimes in zero round-trip time (0-RTT) for returning clients, as it combines transport and encryption handshakes.HTTP/3 mandates TLS 1.3 encryption, providing enhanced security by default, whereas it's optional in HTTP/2.HTTP/3's implementation with QUIC is more efficient and avoids the TCP-level head-of-line blocking issues.HTTP/3 allows connections to persist even when a client's IP address changes (like switching from Wi-Fi to cellular), improving mobile user experience.HTTP/3 uses QUIC as its transport protocol. The ASP.NET Core implementation of HTTP/3 depends on MsQuic to provide QUIC functionality. As a result, ASP.NET Core support of HTTP/3 depends on MsQuic platform requirements. For more information on how to install MsQuic, see QUIC Platform dependencies. If the platform that Kestrel is running on doesn't have all the requirements for HTTP/3, then it's disabled, and Kestrel will fall back to other HTTP protocols.
HTTP/3 is not enabled by default. Add configuration to Program.cs to enable HTTP/3.
:::code language="csharp" source="samples/6.x/KestrelSample/Snippets/Program.cs" id="snippet_Http3" highlight="7-8":::
The preceding code configures port 5001 to:
HttpProtocols.Http1AndHttp2AndHttp3.UseHttps. HTTP/3 requires HTTPS.Because not all routers, firewalls, and proxies properly support HTTP/3, HTTP/3 should be configured together with HTTP/1.1 and HTTP/2. This can be done by specifying HttpProtocols.Http1AndHttp2AndHttp3 as an endpoint's supported protocols.
For more information, see xref:fundamentals/servers/kestrel/endpoints.
QUIC transport options can be configured by calling the xref:Microsoft.AspNetCore.Hosting.WebHostBuilderQuicExtensions.UseQuic%2A extension method on xref:Microsoft.AspNetCore.Hosting.IWebHostBuilder.
:::code language="csharp" source="samples/6.x/KestrelSample/Snippets/Program.cs" id="snippet_UseQuicWithOptions" highlight="3-8":::
The following table describes the available xref:Microsoft.AspNetCore.Server.Kestrel.Transport.Quic.QuicTransportOptions.
HTTP/3 is discovered as an upgrade from HTTP/1.1 or HTTP/2 via the alt-svc header. That means the first request will normally use HTTP/1.1 or HTTP/2 before switching to HTTP/3. Kestrel automatically adds the alt-svc header if HTTP/3 is enabled.
Browsers don't allow self-signed certificates on HTTP/3, such as the Kestrel development certificate.
HttpClient can be used for localhost/loopback testing in .NET 6 or later. Extra configuration is required when using HttpClient to make an HTTP/3 request:
HttpRequestMessage.Version to 3.0, orHttpRequestMessage.VersionPolicy to HttpVersionPolicy.RequestVersionOrHigher.For more information on how to use HTTP/3 with HttpClient, see HTTP/3 with .NET.
:::moniker-end