QPACK
A header compression algorithm used in HTTP/3, similar to HPACK in HTTP/2. It reduces header size through dynamic and static tables, and introduces encoder and decoder streams to address head-of-line blocking.
Timeline (last 90 days)
QPACK is the algorithm used for header compression in HTTP/3, similar to HPACK in HTTP/2.
QPACK runs on top of QUIC, where multiple QUIC streams may arrive out of order; directly reusing HPACK would cause head-of-line blocking.
QPACK introduces two unidirectional control streams, the encoder stream and the decoder stream, distinguishes references to the dynamic table using absolute and relative indices, and coordinates table state through mechanisms such as the known received count.
QPACK's dynamic table capacity is negotiated via SETTINGS parameters, both endpoints must reserve memory for the table, and while references remain unacknowledged the encoder must also limit the number of blocked streams.
In the window before a connection is fully validated, if the server implementation allows Initial or 0-RTT data carrying large header blocks, a limited amplification surface may still form.
If an HTTP/3 server does not limit QPACK header size, it may face a serious amplification attack risk.
Defending against QPACK amplification attacks should limit the size and number of header fields to avoid response inflation.
Defending against QPACK amplification attacks should strictly limit the size of the dynamic table to prevent abuse by attackers.
All Facts (8)
QPACK is the algorithm used for header compression in HTTP/3, similar to HPACK in HTTP/2.
50%UnverifiedQPACK runs on top of QUIC, where multiple QUIC streams may arrive out of order; directly reusing HPACK would cause head-of-line blocking.
50%UnverifiedQPACK introduces two unidirectional control streams, the encoder stream and the decoder stream, distinguishes references to the dynamic table using absolute and relative indices, and coordinates table state through mechanisms such as the known received count.
50%UnverifiedQPACK's dynamic table capacity is negotiated via SETTINGS parameters, both endpoints must reserve memory for the table, and while references remain unacknowledged the encoder must also limit the number of blocked streams.
50%UnverifiedDefending against QPACK amplification attacks should strictly limit the size of the dynamic table to prevent abuse by attackers.
50%UnverifiedIf an HTTP/3 server does not limit QPACK header size, it may face a serious amplification attack risk.
50%UnverifiedDefending against QPACK amplification attacks should limit the size and number of header fields to avoid response inflation.
50%UnverifiedIn the window before a connection is fully validated, if the server implementation allows Initial or 0-RTT data carrying large header blocks, a limited amplification surface may still form.
50%