QUIC is a secure, general-purpose transport protocol, defined by the IETF in RFC 9000, that runs over UDP and builds the TLS handshake into the connection. HTTP/3 uses QUIC as its transport. This matters for proxies: the HTTP CONNECT method tunnels TCP, so QUIC traffic needs a proxy path that can relay UDP.

QUIC uses TLS 1.3 to protect its connections. A server can tell clients that HTTP/3 is available by sending an Alt-Svc header that names the "h3" protocol.

Key Features of QUIC

  • Streams: Data travels over independent streams. With HTTP/2 over TCP, one lost packet stalls every active request, while HTTP/3 over QUIC keeps a loss on one stream from holding up the others.
  • Built-in encryption: The TLS handshake is part of QUIC rather than a separate layer on top.
  • Connection migration: Connection IDs let a connection move to a new network path, such as when a device changes networks.
  • 0-RTT: A client that has connected before can send data immediately on a new connection.

QUIC and Proxies

  • UDP over SOCKS5: SOCKS5 supports UDP through its UDP ASSOCIATE command.
  • UDP over HTTP: RFC 9298 defines CONNECT-UDP, which proxies UDP in HTTP the way CONNECT proxies TCP. Tunneled UDP often carries QUIC.
  • Recommended transport: RFC 9298 says UDP proxying should run over HTTP/3, to avoid duplicate loss recovery when the outer connection uses TCP.

Origin and Standardization

  • 2012: Google started work on QUIC as an alternative to TCP+TLS+HTTP/2, aimed at faster page loads.
  • 2013-2014: Chrome ran small experiments with early versions, now called Google QUIC, then deployed them widely.
  • 2015: Google brought QUIC to the IETF. From 2017, the IETF versions diverged from Google QUIC.
  • 2021: The IETF published QUIC as RFC 9000. Chrome turned it on by default for all users in Chrome 93.

Limitations

  • Blocked UDP: Some networks block all UDP traffic. Studies cited by the IETF put this at about 3% to 5% of networks.
  • Fallback: On those networks, applications must accept the failure or fall back to another transport. For HTTP, the fallback is TLS over TCP.
  • Less visible to networks: QUIC encrypts all payload data and most control information. Only part of the header is exposed to the network.