2026 Cross-Border Link Selection:
HTTP/3 (QUIC) vs HTTP/2

HTTP/2 vs HTTP/3: mechanics on lossy, long-RTT links

HTTP/2 over TCP: after TLS and TCP slow start, all streams share one TCP connection. Loss on one stream can delay delivery of others on the same connection (TCP head-of-line blocking). On paths with RTT 200ms+ and 1–3% loss, that coupling shows up as occasional stalls and P99 spikes.

HTTP/3 over QUIC: handshake and encryption are integrated; streams recover loss independently in QUIC. That helps “many parallel small requests” and “one page, many assets.” Trade-offs: UDP path QoS, carrier policy, and corporate firewalls may be less “always allowed” than TCP 443; CPU and implementation differences create new performance profiles—validate on real paths, not only lab numbers.

Tie-in to remote macOS and CI

Pulling REST APIs from a remote Mac, downloading build artifacts (large files or sharded objects), and long-lived services behind a reverse proxy are all HTTPS semantics plus connection behavior. Picking the right application protocol only fixes the segment “to the edge”; if the origin sits in a single region, HTTP/3 cannot hide transoceanic backhaul—you still need ingress routing, caching, and nearby buckets designed together, aligned with your team’s real egress and global nodes. Learn more: SSH vs VNC vs ARD for cross-border remote development in 2026

Heuristics for three traffic classes

1) APIs (small objects, high QPS, parallel)

Typical pattern: small bodies, many round trips (auth, pagination, nested GraphQL). Under high loss, HTTP/3 often trims tail latency for parallel calls. With low loss but very long RTT and long-lived reused connections, well-tuned HTTP/2 plus TLS session resumption and connection pools may be enough—the deciding factor is whether single-connection stalls are crushing your P99.

2) Artifact pulls (large files, throughput first)

Single-stream large objects are dominated by bandwidth and congestion control; the HTTP/2 vs HTTP/3 gap is often smaller than “regional cache vs none,” Range support, nearby object storage, and runner-side concurrency and timeouts. HTTP/3 shines more on mixed workloads (manifest + many small shards) on one connection than on one giant tarball.

3) WebSocket (long-lived, stateful)

Common stacks remain WebSocket over TCP (HTTP/1.1 Upgrade or HTTP/2 Extended CONNECT). Edge HTTP/3 advertising (Alt-Svc) does not mean WebSocket automatically moves to QUIC. In practice: dedicate WS/WSS hostnames or paths to TCP 443 (HTTP/2 termination), alongside HTTP/3 for static/API traffic. When you need upgraded semantics, evaluate WebTransport and client/browser coverage. Learn more: reverse-proxy WebSocket headers, TLS termination, and tunnel setups

Latency & stability decision matrix (short)

curl probe checklist (client view)

Use these to see what your client actually negotiates on a given path. Run from the same network as your runners (same egress IP / same proxy). Replace https://api.example.com/health with your probe URL.

# TLS + HTTP (trust curl's -w fields)
curl -sS -o /dev/null -w 'http_code=%{http_code} ssl_verify=%{ssl_verify_result} time_total=%{time_total}\n' \
  https://api.example.com/health

# Force HTTP/2 (ALPN h2 on TLS)
curl -sS -o /dev/null --http2 -w 'http_version=%{http_version}\n' \
  https://api.example.com/health

# HTTP/3 (curl must be built with QUIC; failures often hint UDP/ALPN issues)
curl -sS -o /dev/null --http3-only -w 'http_version=%{http_version}\n' \
  https://api.example.com/health

# Compare RTT-related phases: connect / TLS / TTFB
curl -sS -o /dev/null -w \
'lookup=%{time_namelookup} connect=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n' \
  https://api.example.com/health

Feed outputs into your monitoring: compare TTFB and total at P95/P99 for HTTP/2 vs HTTP/3 on the same probe—far more reliable than one-off manual checks. If --http3-only fails consistently, confirm at the edge whether UDP 443 is dropped before advertising Alt-Svc to clients.

Origin and reverse-proxy checklist (starting point)

These are review items, not “copy for instant optimum”—tune per QPS, object size, and where TLS terminates.