Encryptionhttp

PublishedSeptember16th,2015NGINX,Inc.
HTTP/2forWebApplicationDevelopers2HTTP/2forWebApplicationDevelopersTableofContents3Introduction4HTTP/1.
xSoFar5PresentingHTTP/210TestingHTTP/2OnYourSite14Conclusion15Appendix:TheStoryofSPDY16AdditionalResources3HTTP/2forWebApplicationDevelopersIntroductionAsyoumayalreadyknow,HTTP/2isthenewversionofHyperTextTransportProtocol(HTTP),whichwasreleasedasanIETFstandardinearly2015.
HTTP/2supportisnowavailableinsomewebservers,includingNGINX,andinrecentversionsofmostwebbrowsers.
HTTP/2usesasingle,multiplexedconnection,replacingthemultipleconnectionsperdomainthatbrowsersopenedupinHTTP/1.
x.
HTTP/2compressesheaderdataandsendsitinaconcise,binaryformat,ratherthantheplaintextformatusedpreviously.
Byusingasingleconnection,HTTP/2reducestheneedforseveralpopularHTTP/1.
xoptimizations,makingyourwebapplicationssimpler.
HTTP/2iscloselytiedtoSSL.
WhileSSLisnotrequiredbytheHTTP/2specification,allwebbrowsersreleasedsofarwillonlyrunHTTP/2ifawebsitealsousesSSL.
HTTP/2speedsupSSL-enabledwebsitesandmakeswebapplicationssimpler.
WeencourageyoutotestHTTP/2inyourwebapplications,withaviewtomovingontothenewprotocol.
NGINXplayedaleadingroleintheadoptionofSPDY,theprecursorofHTTP/2,andNGINXsoftwareisoftenusedforSSLtermination,amongotherroles.
SoweexpectNGINXtoplayasignificantroleinsupportingimplementationofHTTP/2.
ThiswhitepaperdescribestheobstaclestowebperformancethatareinherentinHTTP/1.
x,theimprovementsfoundinHTTP/2,howtoimplementHTTP/2withNGINX,andhowtounwindHTTP/1.
xoptimizationstomaximizeHTTP/2performance.
ProTip:IfyouwanttoenableHTTP/2andstarttestingthenewprotocolimmediately,youcanjumptothesection,TestingHTTP/2onYourSite.
4HTTP/2forWebApplicationDevelopersHTTP/1.
xSoFarHTTPwasintroducedalongsideHTMLintheearly1990s,whenthewebfirstappeared.
AnHTTPconnectioncouldonlyhandleonemessageatatimeandcouldnotbereused.
Earlywebpagesweresimple;text,headers,andperhapsafewimages,sothisconnectionmodelwassufficient.
Aswebpagesgrewtoincludeimagefiles,CSS,andJavaScript,asingleconnectionwasnolongersufficient.
Manywebpagestodayhavemorethan100separateelements.
Toreducepageloadtimes,browserscreatedmultipleconnectionsatonce-usuallysixtoeight-toallowforsomeparallelisminfiletransfer.
HTTP/1.
1wasintroducedin1999toaddresssomeissueswiththeoriginalHTTP.
Thisupdatetothestandardformalizedthepracticeofusingkeepaliveconnections-connectionsthatcanbere-used.
However,keepaliveconnectionsarestillsubjecttohead-of-lineblocking;arequestforalargefileholdsupmanysubsequentrequestsforsmallerfiles.
ConnectionusageinHTTP/1.
xalsoworksagainstwidespreadadoptionofSSL.
SSLneedsextracyclestoestablishanewconnection,becauseeachconnectionhastobeauthenticated.
Theuseofmultipleconnectionsmeansmorewaittimeforinitialhandshakingtocomplete.
DevelopersuseseveraloptimizationstogetthemostoutoftheavailableconnectionswithHTTP/1.
x:Domainsharding-Filesareparceledouttomultiplesubdomains,withthebrowseropeningsixtoeightconnectionsforeachone.
Thisincreasesparallelisminfiletransferbutaddsmoreconnectionoverhead.
Imagesprites-Imagesarecombinedinonelargefileforefficientdownloading,andeachindividualimageisretrievedbylookup.
Usersmustwaituntilthecombinedfilearrivesbeforetheycanseeanyimagesfromit.
ThelargefilesunderminecachingandtieupRAM.
Concatenatingcodefiles-Allcodeofagiventype(JavaScript,CSS,etc.
)goesintoasinglefile.
Thissavesonconnectionsbutunderminescaching,makestheuserwaitforallthecodebeforeanyofitcanrun,andconsumesextraRAM.
Inliningfiles-CSScode,JavaScriptcode,andevenimagesareinserteddirectlyintotheHTMLfile.
Thisreducesconnectionusage,buttakesupextraRAM,andinitialpagerenderingisdelayeduntiltheenlargedHTMLfilefinishesdownloading.
Theseoptimizationsalsoaddextrastepstodevelopmentanddeploymentworkflows.
Andfinally,extraconnectionsopenedbybrowsers-multipliedbytheuseofdomainsharding-putstrainonnetworks.
Thankfully,theseconnection-relatedtricksarerenderedunnecessarybyHTTP/2andcanbeeliminatedunderthenewstandard.
5HTTP/2forWebApplicationDevelopersPresentingHTTP/2HTTP/2allowsforfaster,moreefficient,moresecuredatatransferinmostapplications.
HTTP/2isbasedonSPDY,afast,non-standardwebtransportprotocolthatwasintroducedbyGooglein2009.
HTTP/2retainsthesamesemanticsasHTTP/1.
1.
ThisincludesHTTPmethodssuchasGETandPOST,statuscodessuchas404(pagenotfound),URLs,andhowheaderfieldsaredefinedandused.
Whileretainingthesecharacteristics,HTTP/2addsfivekeyfeatures:Single,PersistentConnection-Onlyoneconnectionisusedforeachwebpage,asshowninthefigure.
Thesameconnectionisusedaslongasthewebpageisopen.
Multiplexing-Requestsandrepliesareprioritizedandmultiplexedontoseparatestreamswithinthesingleconnection.
Whentheconnectionisstable,"headoflineblocking"-makingeverytransferwaitforallprevioustransferstocomplete-iseliminated.
HeaderCompressionandBinaryEncoding-Headersarecompressedusinganew,separate,securestandard,HPACKcompression,whichreducestheamountofdatacrossingthenetwork.
Headerinformationissentincompact,binaryformat,notasplaintext.
Prioritization-Requestsareassignedlevelsofdependencyandrequestsatthesamelevelareprioritized.
Theserverusesthisinformationtoorderandassignresourcestofulfillingrequests.
SSLEncryption-HTTP/2allowsyoutoaddSSLsupportwith,insomecases,noperformancepenalty,makingyoursitemoresecure.
HowdoesHTTP/2overcometheperformanceoverheadimposedbySSLonHTTP/1.
xTherearefourkeytechniques:1.
HavingasingleconnectionminimizesSSLhandshaking.
2.
Headersarecompressed,reducingthetimeneededtosendthem.
3.
Multiplexingmeansfiletransfersdon'twaitonotherrequests.
4.
Filesdon'tneedtobein-lined,concatenated,orsprited,socachingcanworkoptimally.
Whencomparedtoanon-SSLimplementation,thereisstillSSLperformanceoverheadforauthenticatingthesingleconnectionandforencryptinganddecryptingdata,butthisremaining6HTTP/2forWebApplicationDevelopersoverheadshouldbemoreorlessoffsetbytheperformanceimprovementsinHTTP/2.
YoucanbeginusingHTTP/2foryourwebsitesandwebapplicationswithoutunderstandingitsinternals,butthisinformationcanhelpyouknowwhattoexpectfromHTTP/2intermsofperformancewithyourwebcontent.
Note.
TheHTTP/2specificationalsoincludesserverpush,inwhichtheserversendsfileslistedinapage'sHTMLbeforethey'rerequested.
ServerpushisnotsupportedinNGINX'scurrentimplementationofHTTP/2.
Single,PersistentConnectionLikedrivingacardownanarrowalleyway,anHTTP/1.
1canonlycarryonefileatatime.
AnHTTP/2connectionismultiplexed,allowingdifferentrequestsandresponsestosharethesameconnection.
ThisdifferenceisthebasisformanyofHTTP/2'sbenefits.
AnHTTP/2connectionhasthreeelements:Messages-Arequestorresponse.
Streams-Acallandresponsechannelthatcarriesmessagesintwodirectionssimultaneously.
Aconnectioncanhaveasmanystreamsasneeded.
Frames-Messagesarebrokendownintoframesforsending.
Eachframehasaheaderthatidentifiesitsmessageandstream,soframesfromdifferentmessagescanbeintermixedintherequestorresponsedirectionofastream.
ThefigureshowsthetrafficflowoveranHTTP/2connection.
Twostreams,eachwitharequestandaresponsechannel,carrymultiplexedrequestsandresponses.
Eachrequestandresponseisindependentoftheothers.
7HTTP/2forWebApplicationDevelopersMultiplexingThesingleconnectionusedbyHTTP/2supportsmultiplexing,allowingittobesharedflexiblybypendingrequestsandresponses.
Thetableshowsthetypicalwebbrowser'spage-loadingprocesswithHTTP/1.
1vs.
HTTP/2.
BoldtextintheHTTP/1.
1columnhighlightshowHTTP/1.
1requiresmoretime,moresteps,andmoredatatobetransferred.
HTTP/1.
1PageLoadHTTP/2PageLoad1.
Createsixtoeightconnections.
1.
Createasingleconnection.
2.
RequestHTMLpage.
2.
RequestHTMLpage.
3.
ReceiveHTMLpage.
3.
ReceiveHTMLpage.
4.
DecodeHTMLpage.
4.
DecodeHTMLpage.
5.
RequestfirstsixtoeightfilesincludedintheHTMLpage,noprioritiesordependencies.
(Requestshaveuncompressed,plain-textheaders.
)5.
RequestallfilesincludedintheHTMLpage,withprioritiesanddependencies.
(Requestshavecompressed,binaryheaders.
)6.
Oneachconnection,waitforrequestedfiletoarrive.
(Filesreturned,multiplexedonsingleconnection,asready.
)7.
Requestnextfileonnow-openconnection.
--8.
Repeat6-7foreachremainingfile.
--9.
Closesixconnections.
8.
Closesingleconnection.
ThestepsthatarefasterandmoreefficientforHTTP/2are:1.
Creatingandclosingconnections-HTTP/2createsasingleconnection;HTTP/1.
1createssixtoeight,ormanymoreifdomainshardingisinuse.
2.
Waitingtomakerequests-HTTP/2makesallrequeststogether,withmultiplexingandprioritizationtodeliverhigh-priorityresourcesasquicklyaspossible.
HTTP/1.
1makessixtoeightrequests,thenwaitstoreceiveresponsesbeforemakingadditionalrequests,oneatatimeoneachconnectionasitbecomesavailable.
3.
Sendinglessheaderdata-UnlikeHTTP/1.
1,headerdataforHTTP/2iscompressed,puttinglessdataonthewire.
HeaderCompressionandBinaryEncodingInHTTP/1.
x,headerdataissentasplaintext.
InHTTP/2,headerdataforthesingle,multiplexedconnectioniscompressedaccordingtothenewHPACKstandard,whichusesHuffmancoding.
Headerdataisalsosentinbinaryformat,furtherreducingfilesize.
Headercompressionisnotalwaysabigpositive.
CompressingheaderdataaddsCPUoverhead.
IncaseswheretheuncompressedrequestheaderfitsinasingleTCPpacket,compressiondoesn'thelp.
Forresponses,headerdataisoftenmuchsmallerthantheaccompanyingdata,sothebenefitofheadercompressionissmallaswell.
Bothcompression8HTTP/2forWebApplicationDevelopersandbinaryencodingmakeforobscurityindebugging,comparedtoplaintext.
Telnetcannolongerbeusedfordebugging,butWiresharksupportsHTTP/2.
InHPACKcompression,astatictablecontainsknownheaderfieldsandcommonvalues,eachassignedanindexnumber.
Asheadertransmissionstarts,valuesinthestatictablereplacetextstringsintheheader.
Asheadertransmissioncontinues,adynamictableisbuiltupaswell,assigningcodestonewheader-valuepairs.
Thedynamictableisusedasfieldsrepeatwithinthesession.
Testingshowscompressionofgreaterthan50%onheaderssentbytheclientandnearly90%onheaderssentbytheserver,probablyduetogreateruseofthedynamictableastheconnectionisused.
ThefigureshowsHPACKinuse.
Asthetransferstarts,thestatictable(middlecolumn,top)alreadyhasheader-valuepairssuchas:methodGET(index2).
Astheactualrequestheadersareprocessed,aheader-inpairthatisnotinthestatictable,user-agentMozilla/5.
0,isaddedtothedynamictable(middlecolumn,bottom,index62).
Theencodedheadersthenincludetheindexvalues2and62,ratherthanthemuchlongerheader-valuepairsthattheyrepresent.
PrioritizationHavingasingle,multiplexedconnectionmeansthattheorderinwhichresponsesarereceivedmakesabigdifferenceinperformance.
SoHTTP/2streamshaveaprioritizationweight,whichisanintegerbetween1(lowestpriority)and256(highest),andanystreammaybemadedependentonanother.
Theprioritizationschemeisusedtodeterminetheorderinwhichfilesarerequestedandinwhichtheserverretrievesdata.
Inanoptimalimplementation,forinstance,CSSandJavaScriptfilesaregivenahigherprioritythanimagefiles.
Thisallowscodefilestobedownloadandrunquickly,preventingdelays.
Thecombinationofdependenciesandweightscanbeexpressedasa"prioritizationtree",asshowninthefigure.
TheservercanallocateCPU,memory,andbandwidthtosupporttheprioritizationexpressedbytheclient.
9HTTP/2forWebApplicationDevelopersInthefigure,thelastexampleisthemostcomplex.
First,streamDgetsallavailableresources;streamEandstreamCthensharetheavailableresourcesequally;andstreamAandBthensharetheavailableresources,withstreamAgettingthree-fourthsoftheavailableresources.
Dependenciesandweightscanbechangedbytheclientonthefly,inresponsetouserinteractionandothernewinformation.
Multiplexingandprioritizationoperatetogreatesteffectwhentherearemultiplerequestsoperatinginparallel.
Whenevaluatingperformance,youarelikelytofindthatadvantagesofHTTP/2areless,andtheperformanceslowdownduetoSSLgreater,forverylargefilesandstreamingmediafilessuchasaudioandvideo.
TheremaybecaseswhereHTTP/1.
xwithoutSSLisrequiredforacceptableperformance.
ProTip:Considertestingperformanceandusersuccessonvarioussitetasks-articlesviewed,filedownloads,purchasesmade-beforeandafterHTTP/2implementation.
Seeifsiteresponsetimeimproves,asitshouldwithHTTP/2,andifso,whetheruserscompletemoretasksonthefastersite.
SSLEncryptionSSLisnotarequirementofHTTP/2perse,butcurrentlyshippingbrowsersonlysupportHTTP/2ifserversupportforHTTP/2isenabledandSSLisinuse.
FuturebrowsersupportforHTTP/2isalsolikelytorequireSSLsupport.
AccordingtotheTrustworthyInternetMovement,nearly25%ofthemostpopularwebsitesimplementSSLsite-wide,whereasonly10%didsoin2012.
SSLsitesincludeGoogleSearch,Gmail,andGoogleDocs,aswellasFacebookandYahoo!
.
NewconnectionsareexpensivewithSSL;eachrequiresacomputationallyintensiveexchangeofkeys–typically,anRSA2kpublic/privatekeypair.
But,underHTTP/2,onlyoneinitialconnectionisneeded,insteadofsixtoeightunderHTTP/1.
x(morewithdomainsharding).
IfyoualreadyuseSSLthenmovingtoHTTP/2,withitssingle,persistentconnection,willcutSSLoverhead.
If,notusingSSLalready,youadditinamovetoHTTP/2,youwilllikelyseetheslowdownfromSSLmoreorlessoffsetbytheperformancebenefitfromHTTP/2.
Formoredetailsonsecureconnections,andquotesfromFacebook,Google,Twitterandothersastothemanageabilityoftheassociatedoverhead,seethewebsite,IsTLSFastYet.
10HTTP/2forWebApplicationDevelopersTestingHTTP/2onYourSiteYoucaneasilyimplementHTTP/2inawebapplicationthatalreadyusesNGINXorNGINXPlus.
Inmostcases,NGINXwillbeinfrontofotherwebservers,providingcapabilitiessuchasloadbalancing,contentcaching,andSSLtermination.
TurningonHTTP/2ontheNGINXserverenablesHTTP/2forclientcommunications,butdoesn'taffecttheotherservers,sinceNGINXusesHTTP/1.
xorotherappropriateprotocoltocommunicatewiththem,asshowninthefigure.
ManyoftheinfrastructurechangesrequiredtoaddHTTP/2supporttoyourwebsitewillbeautomaticfromthepointofviewofbothusersandwebsiteoperators.
Onceyou'veappliedthebetapatchtoNGINX,therearejustafewthingsyouneedtodotouseHTTP/2atyoursite:1.
SSL-enableyourwebsite.
2.
Installup-to-dateSSLsoftware.
3.
TurnonHTTP/2supportinNGINX.
4.
UnwindHTTP/1.
1optimizationsthatreduceperformanceforHTTP/2.
Assoonasthefirstthreestepsarecompleted,browsersthatsupportHTTP/2willuseitwhenrequestingwebcontent.
Then,asconvenient,unwindanyperformanceoptimizationsthatyou'veimplementedforHTTP/1.
1,asdescribedbelow.
MakingthesechangeswillsimplifyyourwebapplicationsandimprovetheperformanceofyourwebsiteunderHTTP/2.
Note.
Forfastperformancetodayinproductionenvironments,considerusingSPDY/3.
1onNGINXorNGINXPlus.
SPDYiscurrentlysupportedbymorewebbrowserversionsthanHTTP/2andworkswithearlierversionsofSSL.
CaveatsAfewnotesaboutHTTP/2withNGINXandNGINXPlus:Serverpush-TheHTTP/2serverpushfeatureisnotsupportedinthispatchandwillnotbesupportedinthefirstproduction-readyreleasewithHTTP/2support.
Serverpushmayappearinfuturereleases.
11HTTP/2forWebApplicationDevelopersHTTP/1traffic-EvenafteryouenableHTTP/2,trafficfromolderbrowserversionsthatdonotsupportHTTP/2willcontinuetocommunicatewithyourwebapplicationusingHTTP/1(currentlyabout50%each).
ExpecttotestagainstHTTP/1.
xandsupportit,evenasyourHTTP/2sharegrows,forseveralyearstocome.
SPDYremoved–NGINXversionswithHTTP/2enabledbydefault,asdescribedinStep3below,nolongersupportSPDY.
SPDYisbeingdeprecatedbyGoogleasofearly2016,sothereisnoneedtosupportboth.
1.
SSL-EnableYourWebsiteTheHTTP/2specificationdoesnotrequirethatSSLbeinforce,butcurrentbrowsersdo.
SoSSL-enableyourwebsitetogetitreadyforHTTP/2.
Followthesesteps:1.
GetanSSLcertificate.
Newproviders,somefree,haverecentlycomeonline.
2.
Updateembeddedlinksfromhttptohttps,orhaveNGINXredirectallyouruserstotheSSL-encryptedsitewiththecodesnippetbelow.
server{listen80;location/{return301https://$host$request_uri;}}WithSSLenabled,whenauseraccessesyoursiteusinganHTTP/2-awarewebbrowser,thebrowserwillattempttoconnecttoyourwebserverusingHTTP/2.
Note:YouwillneedtoassessperformancebeforeandaftermovingtoSSLandbeforeandaftermovingtoHTTP/2.
Thisincludesresponsetimeandpeakcapacity.
Besurethatyourhostservercanstillhandlethesameloadaspreviously,bothintermsofresponsetimeandCPUusage.
2.
InstallUp-to-DateSSLSoftwareandLinktoItTheNGINXimplementationofHTTP/2usestheApplicationLayerProtocolNegotiation(ALPN)extensiontoTLS.
PriortoenablingHTTP/2,youmustinstallOpenSSL1.
0.
2,whichincludesALPNsupport,oralaterversion,onyourNGINXservers.
ThenlinktoOpenSSL,asdescribedinStep5ofthisNGINXblogpost.
Note.
Currently,theFirefox(Firefoxversion39)andChrome(Chromiumversion44)browsersalsosupportHTTP/2negotiationusingNextProtocolNegotiation(NPN),whichisavailableinOpenSSL1.
0.
1andlater.
Thissupportisdeprecatedandisduetoberemovedfromthebrowsersinspring2016.
However,fornow,youcanrunonOpenSSL1.
0.
1usingNPNifneeded.
3.
TurnOnHTTP/2inYourServerInordertofinishthemovetoHTTP/2,yourwebserverneedstobereadytoreceiveHTTP/2requests.
YouwillalsowanttoaddanHTTP/1.
x-to-HTTP/2redirector.
12HTTP/2forWebApplicationDevelopersNGINXPlususerssimplyneedtousetheHTTP/2-enabledpackagenginx-plus-http2.
ForNGINXopensource,useVersion1.
9.
6orlater.
ForanyHTTP/2-enabledversionofNGINX,dothefollowing:1.
Addthehttp2parameterand,ifnotalreadyinplace,thesslparameter,toexistinglistendirectives-butfirst,addaURLredirectorforHTTP/1.
x:server{listenserver_namereturn80;nginx.
com;301https://www.
nginx.
com$request_uri;}server{listen443sslhttp2default_server;ssl_certificateserver.
crt;ssl_certificate_keyserver.
key;…}2.
RestartNGINX:#nginx-sreload3.
VerifythatHTTP/2isindeedbeingused.
OnegoodwaytodothisistousetheHTTP/2andSPDYindicatorpluginforGoogleChrome.
Thefigureshowstheplugininuse;abluelightningboltinthebrowseraddressbarshowsthatHTTP/2isactive.
Thewebpageshowstheprotocolas"h2",shortforHTTP/2.
13HTTP/2forWebApplicationDevelopersIfyouhaveanyproxydevices,suchasloadbalancers,ContentDeliveryNetworks(CDNs),andWebApplicationFirewalls(WAFs),theyshouldbemovedbehindtheNGINXserver,sothattheclientcommunicateswithNGINXfirst.
Note:IfyouwanttostaywithHTTP/1forserver-to-servercommunications,youneedtodeployanHTTP/2-to-HTTP/1proxy.
YoucanputanNGINXserverinfrontofyourotherserversasanHTTP/2gatewayandforSSLtermination,asNGINXsupportsHTTP/2connectionsfromwebclientsandautomaticallyusesHTTP/1forcommunicationwiththeserversitisproxying.
4.
ReviewHTTP/1.
1OptimizationsUnderHTTP/2,HTTP/1.
xoptimizationsarelikelytohurtperformance,soyoushouldconsiderremovingthem.
Here'sabrieflistingofthechangestoconsiderandthepotentialbenefits:Domainsharding.
Hostfileswithinasingledomaintosatisfyallrequests.
Thiscutsconnectionoverheadandsimplifieswebsitemanagement.
(IfsomeoralloftheURLsthatyoucurrentlyusecanberesolvedtoasingledomain,andyouhaveawildcardSSLcertificatethatcoversallofthesubdomainsinuse,HTTP/2willtreatthemasone,effectivelyoverridingsharding.
)Imagespriting,concatenatedfiles,inlinedfiles.
Considerremovingorreducingspritingofimages,concatenationofcodefiles,andinliningofdataintoHTMLfiles.
BreakingupcombinedfilescancuttheinitialHTMLfiledownloadtime;reducelonginitialwaitsforlargerfilestodownload;cutsthememoryfootprintofyourwebpage,asyoudon'tneedtokeepbigimageandcodefilesinmemory;andallowscachingtoworkproperlyatalllevels,fromthebrowseronup.
Keepingfilesseparatealsosimplifiesworkflowforsitecreationandmaintenance.
YoumayneedtoexperimenttofindoutwhatpracticesyieldoptimalperformanceunderHTTP/2.
AccessingmanysmallfilesmayslowperformanceevenunderHTTP/2.
Also,largerfilesmightcompressbetterthansmallerfiles,duetoalargercompressioncontext.
Considertestingtoidentifyinstanceswherelimiteduseofimagespriting,fileconcatenation,andfileinliningmightstillbenefitperformance,evenunderHTTP/2.
(Forinstance,youmayfinditworthwhiletospriteagroupofimageswhichmakeupapagenavigationblock.
)Alimitedimplementationofshardingmayalsooffermodestperformanceadvantages,evenintheHTTP/2context.
IfyouuseaCDN,youwillneedtoevaluatewhetheritstilldeliversimprovedperformanceunderHTTP/2.
WhenyoudoimplementHTTP/2,youhavetheopportunityforanaturalexperiment-achancetodocomparisontestinginareal-worldenvironment.
Manyofyouruserswillbeusingbrowserversionsthatdon'tsupportHTTP/2;otheruserswillbeusingbrowserversionsthatdo.
YoucancompareandcontrastperformanceonthetwoprotocolstohelpyouoptimizeyourcodeforHTTP/2performancewithoutaffectingperformancefortheremainingHTTP/1/xuserstoomuch.
ProTip.
Bereadyforincreasedworkintesting,asyouwillneedtotestnewreleasesonbothHTTP/1.
x,forbrowserversionsthatonlysupportthat,andHTTP/2forup-to-datebrowserversions.
14HTTP/2forWebApplicationDevelopersConclusionHTTP/2isanexcitingnewoptionforwebapplications.
Itprovidesstrongsupportformoresecure,simpler,fastersites.
Inadditiontotakingthespecificstepsabove,youmayneedtoconsiderotherimplementationapproaches.
ToimplementHTTP/2inamixedserverenvironment,youcanuseNGINXasanHTTP/2gateway,withSSLterminationincluded.
SimplyputanNGINXserverinfrontofotherserversandenableHTTP/2,asdescribedabove.
TheNGINXserverwillspeakHTTP/1.
xorHTTP/2tobrowsers,asrequired,andHTTP/1.
xandotherprotocolstoproxiedservers.
Youmayalsoneedtoreviewotherimplementationstrategies.
Forinstance,underHTTP/2,CDNsmaylosesomeoftheiradvantage;thebenefitsofusingfasterservers,orserversoneortwostepsclosertotheuser,maybeoffsetbytheextraoverheadofopeningupadditionalconnectionstoaccesstheCDNservers.
(AccordingtotheHTTPArchive,about40%ofthetop1000sitesuseaCDN,sothishasbigimplicationsforsitearchitecture.
)WithHTTP/2,thedomainshardingthat'seasilyimplementedthroughCDNsisnolongeranadvantage,whiletheextrahandshakingneededtoaccessseparateserverswillhurtperformance,withlessoffsettingadvantageduetomultipleconnectionsforfiletransfer.
YouandothersmayfindnewanddifferentperformancetechniquesthathelpyourwebapplicationunderHTTP/2.
Expecttofindlivelyonlinediscussionsaboutthebestwaystousethenewprotocol.
Wehopethiswhitepaperisausefulearlystepinyourjourneytowardgainingthesimplicity,siteperformanceimprovements,andsecurityofferedbyHTTP/2foryourwebapplications.
15HTTP/2forWebApplicationDevelopersAppendix:TheStoryofSPDYSPDYistheprecursortoHTTP/2.
SPDYwasinitiallydevelopedbyGoogleandintroducedin2009asanopen,experimental,non-standardprotocolforspeedinguptheweb.
InmanywaysitisthefoundationforHTTP/2,andisinuseacrossroughly5%ofwebsitesasofAugust2015.
SPDYwasdesignedtospeedupwebsiteswhilerequiringminimalchangesintheinfrastructureoftheInternet.
ThekeytechniquesusedarethesamethatwenowseeinHTTP/2:UseasingleInternetconnection,withrequestsandresponsesmultiplexedonit.
Usebinaryformat,ratherthanplaintext,forheaders.
Compressheaders.
Prioritizerequestsandresponseswithinthesingleconnection.
RequireSSLonallsitesthatsupportthenewprotocol.
SPDYachievedsignificantperformanceimprovementsformostwebsites,withsomepagesloadingmorethan50%faster.
ForSPDYtobeuseful,bothwebserversandwebclientsneedtosupportit.
NGINXisbyfarthemostpopularwebserverthatsupportsSPDY;asofthiswriting,about77%ofsitesthatuseSPDYuseNGINX.
Currently,mostbrowserversionsinactiveusesupportSPDY.
Google,Facebook,andTwitteruseSPDY,andWordPresssiteshavebeenthelargestgeneratorsofSPDYtraffic.
(WordPressrunsonNGINX.
)HTTP/2isbasedonSPDY,withafewchanges.
Themajorchangesare:CompressionisbyHPACKinsteadofZLIB.
HTTP/2makestheprioritizationschememorecomplexandmorepowerful.
DuringtheyearsinwhichHTTP/2wasbeingdeveloped,SPDYwasusedtotestalternativesforusewithinHTTP/2.
WhenHTTP/2wasstandardizedinmid-2015,SPDYsupportwasdeprecated,andSPDYusageisnowexpectedtodecreasesteadily.
16HTTP/2forWebApplicationDevelopersAdditionalResourcesFollowingareafewkeyresourcesforunderstandingHTTP/2:SPDYwhitepaper-TheGoogleChrometeamintroducedSPDYwithawhitepaper.
SPDYblogpost-Google'sIlyaGrigorikexplainssomeSPDYdetails.
HTTP/2Wikipediaentry-IncludesdifferenceswithHTTP/1.
x.
HTTP/2talkandslidedeck-IlyaexplainsthebenefitsofHTTP/2.
HTTP/2RFCandFAQ-TheofficialspecificationforHTTP/2,publishedasaRequestforComment(RFC)onGithub,plusFrequentlyAskedQuestions(FAQ).
HPACKdefinition-TheRFCforHPACKcompression.
OverclockingSSL-Write-upofatalkonSSL/TLShandshakeperformancecosts,includinghandshaking.
HTTP/2chapter-ThechapteronHTTP/2fromIlya'sbook,HighPerformanceBrowserNetworking.
HTTP/2Tradeoffs-Google'sWilliamChancarefullyanalyzesHTTP/2plusesandminuses.
NGINXPlansforSupportingHTTP/2-OwenGarrettofNGINXdescribesthecompany'ssupportforSPDYandplanstosupportHTTP/2.