HTTP/2: Browser Support, Features, Known Issues

What is HTTP/2?

HTTP/2 is a major revision of the Hypertext Transfer Protocol that the IETF HTTP Working Group standardized in RFC 7540 and updated in RFC 9113. It evolved from Google's experimental SPDY project and replaces HTTP/1.1's plain-text framing with a binary protocol that adds multiplexing, header compression with HPACK, and stream prioritization. The protocol keeps the same methods, status codes, URIs, and header fields as HTTP/1.1, so existing web applications work without code changes.

Which browsers does HTTP/2 support?

All major browsers support HTTP/2 by default, but only over TLS. Chrome 41, Edge 12, Firefox 36, Safari 11 on macOS, Safari 9 on iOS, Opera 28, Samsung Internet 4, and Android Browser 147 enable HTTP/2 out of the box, while Opera Mini and Internet Explorer 10 and earlier never added support.

What are the key features of HTTP/2?

HTTP/2 keeps every HTTP/1.1 verb and header but rewires how the protocol moves bytes on the wire. Five features carry most of the performance win.

• Binary framing: HTTP/2 sends every message as a binary frame with a fixed header. Binary parses faster than text, removes whitespace and capitalization edge cases, and uses a single parsing path instead of HTTP/1.1's four.
• Stream multiplexing: A single TCP connection carries many independent streams. The browser can send dozens of requests in parallel without opening a new socket per resource, which removes HTTP/1.1's head-of-line blocking at the request level.
• HPACK header compression: HTTP/2 compresses request and response headers with HPACK, defined in RFC 7541. HPACK uses a fixed Huffman code and a dynamic table, so repeated headers like cookies and user agents shrink to a few bytes per request.
• Stream prioritization: Clients tag each stream with a weight and dependency. Servers use the priority tree to send critical CSS and above-the-fold images before low-priority assets like footers and analytics scripts.
• Server push: The protocol allows a server to push resources before the client asks. Browser support for server push has been removed in practice, with Chrome and Firefox shipping their respective deprecations, so the feature is no longer a deployment target.

How do you check if a browser is using HTTP/2?

The fastest check is the DevTools Network panel. Right-click the column headers, enable the Protocol column, and reload the page. Resources served over HTTP/2 list h2 in that column. For automated checks across pages, the PerformanceResourceTiming API exposes nextHopProtocol with the same value.

Paste this snippet into any browser DevTools console after the page finishes loading to count how many resources used HTTP/2, HTTP/3, or HTTP/1.1.

// Run in any browser DevTools console after the page finishes loading.
// PerformanceResourceTiming reports the protocol the browser negotiated.

const entries = performance.getEntriesByType("resource");
const counts = { "h2": 0, "h3": 0, "http/1.1": 0, "other": 0 };

for (const entry of entries) {
    const proto = entry.nextHopProtocol;
    if (proto in counts) {
        counts[proto] += 1;
    } else {
        counts.other += 1;
    }
}

console.log("Protocol counts on this page:", counts);
const total = entries.length || 1;
console.log("HTTP/2 share:", ((counts["h2"] / total) * 100).toFixed(1) + "%");
// HTTP/2 reports as "h2" in nextHopProtocol when ALPN selected it.
// HTTP/1.1 reports as "http/1.1", and HTTP/3 reports as "h3".

If every resource reports http/1.1 instead of h2, the server is not advertising HTTP/2 over ALPN, the site is being served over plain HTTP, or a corporate proxy is downgrading the connection. Browsers never speak HTTP/2 in clear text on the open web.

What are the known issues with HTTP/2?

HTTP/2 is mature and ships in every modern browser, but the protocol still has rough edges that affect production traffic. Plan for these before you treat HTTP/2 as a finished problem.

• TCP head-of-line blocking: HTTP/2 multiplexes streams over a single TCP socket. A single dropped packet stalls every stream until TCP retransmits it. The HTTP/3 working group cited this as the main reason to move to QUIC over UDP.
• Rapid Reset, CVE-2023-44487: Attackers open many HTTP/2 streams and immediately cancel each one, forcing the server to spend CPU on requests that never complete. The fix is a server-side patch, so any HTTP/2 origin still needs an updated stack.
• Server push is dead in browsers: Chrome and Firefox have both removed HTTP/2 server push. Sites that built around PUSH_PROMISE frames need to switch to rel="preload" links and the 103 Early Hints status code instead.
• HTTPS-only on the open web: The HTTP/2 spec allows clear-text h2c, but no browser supports it. A site without TLS cannot negotiate HTTP/2, which means HTTP/2 only ships where there is a valid certificate.
• Internet Explorer fallbacks: Internet Explorer 11 only supports HTTP/2 partially on Windows 10 and Windows 8.1, and earlier IE versions do not support it at all. Sites that still receive IE traffic see those requests fall back to HTTP/1.1.
• In my experience: the loudest HTTP/2 production issue is connection coalescing behind shared CDNs. Two domains share an HTTP/2 connection because the certificate covers both, then one domain's GOAWAY tanks the other domain's requests. Always test from a real browser on real network paths, not just curl from a clean lab box.

Citations

All HTTP/2 version numbers and platform notes in this guide come from these primary sources:

• IETF RFC 9113 (HTTP/2): datatracker.ietf.org/doc/html/rfc9113
• IETF RFC 7540 (HTTP/2 original spec): datatracker.ietf.org/doc/html/rfc7540
• IETF RFC 7541 (HPACK header compression): datatracker.ietf.org/doc/html/rfc7541
• MDN HTTP/2 Glossary: developer.mozilla.org/en-US/docs/Glossary/HTTP_2
• Wikipedia HTTP/2: en.wikipedia.org/wiki/HTTP/2
• HTTP/2 official FAQ: http2.github.io/faq
• Chrome for Developers, removing HTTP/2 server push: developer.chrome.com/blog/removing-push
• Chrome Platform Status, remove HTTP/2 push: chromestatus.com/feature/6302414934114304
• Microsoft Learn, HTTP/2 support in Azure Front Door: learn.microsoft.com/en-us/azure/frontdoor/front-door-http2
• CISA, HTTP/2 Rapid Reset (CVE-2023-44487): cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487
• Cloudflare blog, HTTP/2 Rapid Reset deconstruction: blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack