HTTP in 2022: New Specs, Protocol Shifts, and What Comes Next

HTTP has sustained its central role on the Internet for over three decades. Its longevity isn't accidental. The protocol balances utility and complexity well enough to serve browsing, media streaming, APIs, and even other protocols built atop it. The HTTP Working Group's 2022 Best Current Practice document, "Building Protocols with HTTP," attributes much of this success to broad implementer familiarity, a wealth of pre-existing client and server tools, and the ease of traversing firewalls. Perhaps equally crucial is the active community of engineers and specifiers who keep HTTP interoperable and aligned with modern demands. Companies like Cloudflare contribute directly through IETF participation and events such as the HTTP Workshop, mapping out practical pain points and future changes.

The Big Deliverable: HTTP/3 Goes Official

The headline specification event of 2022 was the formal publication of HTTP/3, which uses QUIC as its transport. While the technical work wrapped up in 2021 alongside QUIC version 1, the release was deliberately held to align with a set of related documents.

HTTP's evolution has been a long arc of addressing performance bottlenecks. HTTP/0.9 and HTTP/1.0 opened a fresh TCP connection per request, an approach that quickly proved inefficient. HTTP/1.1's persistent connections were a major step forward, yet they left head-of-line blocking unresolved: a single outstanding request could stall every other request sharing that connection. HTTP/2 (2015) solved this at the application layer, only to expose the same underlying problem in TCP. Since TCP delivers data in strict order, one lost packet can stall a flow even when later segments are already buffered. That flaw became increasingly visible on imperfect networks.

QUIC replaced TCP to solve this once more by providing multiplexed, ordered streams over UDP without the head-of-line penalties of TCP. HTTP/3 follows that model. 2022 saw growing real-world adoption and improved confidence on that front, and while some might wonder whether HTTP/4 is near, the community shows little appetite for another version so soon. QUIC and HTTP/3 are still young, with extensibility mechanisms designed to absorb change without another full protocol revision.

The "Core" Specifications Get a Refresh

Beyond HTTP/3, 2022 marked the arrival of the refreshed "core" HTTP documents:

HTTP/2 was also republished to realign with the updated Semantics document and resolve a few lingering issues. These are successors to the RFC 723x set, RFC 2616, and others reaching back to RFC 1945. Each generation of edits aims to enhance readability, correct errors, refine explanations, and clarify tricky protocol behavior. Outdated features get deprecated and new ones added as needed. The earlier RFCs should now be considered obsolete; refer to the latest revisions above for authoritative details.

Early Hints: A Safer Successor to Server Push

HTTP/2 shipped with server push and high expectations. In practice, however, predicting what a client would need — and at what network moment — proved nearly impossible. Over-push meant injected resources competed directly with legitimate browser requests, costing more in performance than it saved. The situation worsened if the browser already had those resources cached, making the push entirely redundant. By 2022, Chrome removed support for server push, and the broader community has largely relegated it to niche niches like the Web Push Protocol.

The replacement, the 103 (Early Hints) status code, has been around as an Experimental RFC since 2017 but gathered real momentum through 2022. It lets a server send preliminary hints about linked resources before producing the full final response. That early signal is particularly beneficial where generating a response takes time, such as a CDN assembling an out-of-band resource. While theoretically push was more efficient at the network level, Early Hints have proven far safer to deploy without significant downside risk. Cloudflare and partners like Shopify and Google reported meaningful improvements in key performance metrics. Cloudflare has already integrated Early Hints into Cloudflare Pages and sees broader applications on the horizon.

New Uses for Intermediation: Tunnels and Privacy

A significant thread of 2022's HTTP extension work focused on intermediation — inserting proxies or gateways into the flow. The MASQUE Working Group expanded tunneling beyond the classic TCP-only CONNECT method, adding UDP tunneling support. That opens the door to efficiently tunnel protocols like QUIC and HTTP/3 themselves. Cloudflare is working with Apple on deploying MASQUE for iCloud Private Relay, and is eyeing future IP tunneling use cases that could power MASQUE-based VPNs.

Also making progress is Oblivious HTTP (OHTTP), which layers sets of intermediaries to prevent servers from using connection details or IP addresses as tracking tokens. OHTTP has applications for sensitive telemetry and other data collection. Cloudflare is using it as the basis for a new Privacy Gateway product aimed at shielding the identities of end users from applications.

These developments share a common philosophy: intermediation enables privacy-relevant partitioning of communication, a concept that broader Internet architecture discussions are increasingly exploring.

Strengthening HTTP Security

Several HTTP security-focused specifications also advanced meaningfully in 2022. The Digest Fields update revives and modernizes the long-neglected Digest header to provide message integrity digests. Meanwhile, HTTP Message Signatures brings standardized cryptographic signing mechanisms to HTTP requests and responses. Both specifications are in the end-game of the IETF process.

The Cookie specification revision also saw major progress, with completion expected shortly. Rather than eliminating cookies temporarily, this revision works on constraining their operation via a new SameSite attribute, boosting privacy and security settings by default.

The Privacy Pass effort — sometimes called "Private Access Tokens" — gained notable traction. Implemented as a new HTTP authentication scheme, these cryptographic tokens prove a client is human without resorting to CAPTCHAs or invasive activity tracking. Apple deployed the scheme broadly in 2022, and Cloudflare's Turnstile alternative relies on it as well. The specification is close to finalization.

What's on the Workbench for 2023 and Beyond

The HTTP Working Group has more unfinished business. Work items include a QUERY method for requests with bodies, Resumable Uploads (built on tus), Variants to refine caching behavior using the Vary header, structured field improvements adding a Date type, and efforts to modernize existing headers for conversion to structured formats.

Community conversations in the 2022 HTTP Workshop touched on still more possibilities: shared protocol testing infrastructure that could offload simple tool development and de-duplicate effort; overhauling Alternative Services for more precise connection management; and exploring alternative binary header serializations. Discussions also continued around whether HTTP should natively support pub/sub patterns, or whether that responsibility should remain with WebSockets or the emerging WebTransport protocol. There's tangential early work on Media over QUIC that could surface new opportunities.

None of this is predictable exactly, but the protocol's centrality ensures that its continued evolution will remain tightly interwoven with the web's own progression. HTTP remains actively shaped by its community in a constant search for better performance, privacy, and usability — all while sustaining compatibility with the largest hypertext system ever built.