HTTP/3 Inspection Comes to Cloudflare Gateway

Cloudflare has announced that its secure web gateway, Cloudflare Gateway, will soon support inspection of HTTP/3 traffic. HTTP/3 now accounts for roughly 25% of Internet traffic, but until this update, administrators who wanted to filter and inspect HTTP/3-enabled sites or APIs had to choose between falling back to HTTP/2 (sacrificing performance) or skipping inspection altogether (sacrificing visibility). The new capability aims to deliver both full traffic visibility and the faster browsing experience that HTTP/3 provides.

Why HTTP/3 Matters

HTTP/3 is built on QUIC, a transport protocol that is encrypted by default. Compared with earlier HTTP versions, it reduces round-trips between the user and the web server, which makes it particularly beneficial for users on unreliable connections. Cloudflare has been involved in the protocol's evolution since the early days, working with the IETF on the HTTP/3 and QUIC specifications. The company first supported QUIC in September 2018 and followed with HTTP/3 support for its reverse proxy services in September 2019. It now supports the final "h3" identifier per RFC 9114.

The Inspection Gap

While HTTP/3 keeps familiar HTTP request and response semantics, it differs architecturally from legacy TCP-based protocols. Because QUIC runs over UDP, traditional secure web gateways have poor support for it. Without native HTTP/3 inspection, administrators faced a set of unattractive options: leave UDP traffic uninspected, forgo security features like inline anti-virus scanning, data-loss prevention, browser isolation, or traffic logging, or proactively disable HTTP/3 in end-user browsers. The last option adds deployment complexity and negates the performance benefits of the protocol.

Enabling the New Capability

When HTTP/3 inspection becomes available for select browsers later this year, it will be turned on through the Zero Trust dashboard. Administrators will need to enable proxying, check the box for UDP traffic, and turn on TLS decryption under Settings > Network > Firewall. Once those settings are active, AV scanning, remote browser isolation, DLP, and HTTP filtering can be applied via HTTP policies to all proxied HTTP traffic.

HTTP/3 inspection will be available to all administrators regardless of plan type. Cloudflare says it will notify Cloudflare One customers once the feature is live.