HTTP/3 working with proxysg

Products

• ProxySG Software - SGOS
• Advanced Secure Gateway Software - ASG

Issue/Introduction

HTTP/3 working with  ProxySG/ASG.

Resolution

HTTP/3 generally doesn’t work for the first request because browsers assume by default that the server doesn’t support HTTP/3 and send the first request via either HTTP/2 or HTTP/1.1 on a TCP connection.

If the server supports HTTP/3, it responds with an Alt-Svc (Alternative Service) header that informs the client that it can send HTTP/3 requests. The browser can respond in different ways: it can open a QUIC connection right away or wait until the TCP connection is closed.

Either way, an HTTP/3 connection is only set up after the initial resources have been downloaded over an HTTP/1.1 or HTTP/2 connection.

That's without a ProxySG, with ProxySG in between the browser is going to assume HTTP/1.1 or H2, so for explicit proxy, there's no issue.

For transparent proxy, it depends as below:

1) For inline, the proxy will intercept the traffic, and the Alt-Svc header will not be used.
2) If the request came as UDP, it'll be dropped or forwarded, depending on the configuration.
3) If it's transparent redirection by a TCP port, then the proxy will never see the UDP traffic.