JIYIK CN >

HTTP 1.1 is limited to handling only one outstanding request per TCP connection, forcing browsers to use multiple TCP connections to handle multiple requests simultaneously.

However, using too many TCP connections in parallel can cause TCP congestion, creating an unfair monopoly of network resources. Web browsers that use multiple connections to handle additional requests take up more of the available network resources, thus reducing network performance for other users.

Making multiple requests from the browser also results in duplication of data on the data transmission wire, which in turn requires additional protocols to extract the required information without errors at the end node.

The Internet industry was naturally forced to crack these limitations with practices such as domain sharding, joins, data inlining, and springs. The inefficient use of the underlying TCP connection in HTTP 1.1 also led to low resource priority, causing web applications to degrade exponentially in terms of complexity, functionality, and scope.

The web has evolved far beyond the capabilities of traditional HTTP-based network technologies. The core features of HTTP 1.1, developed more than a decade ago, opened the door to some embarrassing performance and security vulnerabilities.

For example, cookie hacking allowed cybercriminals to reuse previously working sessions to leak account passwords because HTTP 1.1 does not provide session endpoint identification capabilities. While similar security issues will continue to plague HTTP/2, the new application protocol has been designed with better security features, such as improved implementation of new TLS features.