The life of an HTTPS request

HOW IT FITS TOGETHER

KEY TERMS

TLS 1.3 1-RTT handshake

The ClientHello carries a key share, so after one round trip both sides have keys and the client can send its request with its Finished message. TLS 1.2 needed two round trips.

0-RTT early data

On resumption, a client can send a request in its first flight under a pre-shared key. Early data is not forward secret and can be replayed across connections, so only idempotent requests belong there. Servers can answer 425 Too Early to force a retry after the handshake (RFC 8470).

ALPN

A TLS extension in which the client lists protocols (h2, http/1.1) and the server picks one. This is how HTTP/2 is negotiated without an extra round trip. HTTP/3 is discovered separately, usually via an Alt-Svc response header.

HTTP/2 multiplexing

Many concurrent requests share one TCP connection as interleaved streams. This removes application-level head-of-line blocking, but TCP still delivers bytes in order, so one lost packet stalls all streams.

HTTP/3 and QUIC

QUIC runs over UDP, implements reliability and congestion control per connection with per-stream ordering, and combines transport and TLS 1.3 handshakes into one round trip. Some networks block or throttle UDP, so clients race or fall back to TCP.

Connection reuse

Clients pool idle connections per origin and reuse them for later requests, skipping DNS, TCP and TLS. Reuse fails when you create a client per request, leave response bodies unread, or keep idle sockets longer than the server or load balancer does.

CDN and shared caching

Requests usually terminate TLS at a nearby edge. Cache-Control s-maxage governs shared caches separately from max-age in browsers, and ETag/If-None-Match turns a refetch into a 304 without a body.

IN YOUR STACK

export async function getJSON(url, { timeoutMs = 5_000, signal } = {}) {
  const signals = [AbortSignal.timeout(timeoutMs)];
  if (signal) signals.push(signal); // e.g. a component unmount or user cancel

  const res = await fetch(url, {
    signal: AbortSignal.any(signals),
    headers: { Accept: "application/json" },
  });
  if (!res.ok) {
    await res.body?.cancel(); // free the connection instead of leaving it half-read
    throw new Error(`HTTP ${res.status} for ${url}`);
  }
  return res.json(); // the signal still applies while the body streams
}

try {
  const quote = await getJSON("https://api.example.com/quotes/42");
} catch (err) {
  if (err.name === "TimeoutError") reportTimeout();
  else if (err.name !== "AbortError") throw err;
}

import { Agent, fetch } from "undici";

// One Agent per process or per upstream: it owns the connection pool.
const pricing = new Agent({
  connect: { timeout: 2_000 }, // TCP + TLS handshake, ms
  headersTimeout: 5_000,       // until response headers arrive
  bodyTimeout: 10_000,         // while receiving body data
  keepAliveTimeout: 4_000,     // idle socket lifetime; keep below the server's
  connections: 64,             // max sockets per origin
});

export async function getQuote(id: string) {
  const res = await fetch(`https://pricing.internal/quotes/${id}`, {
    dispatcher: pricing,
    signal: AbortSignal.timeout(8_000), // overall deadline across all phases
  });
  if (!res.ok) {
    await res.body?.cancel();
    throw new Error(`pricing ${res.status}`);
  }
  return res.json();
}

var client = &http.Client{
	Timeout: 10 * time.Second, // whole exchange, including reading the body
	Transport: func() *http.Transport {
		t := http.DefaultTransport.(*http.Transport).Clone()
		t.MaxIdleConnsPerHost = 32 // default is 2, which churns busy upstreams
		t.ResponseHeaderTimeout = 5 * time.Second
		return t
	}(),
}
func getQuote(ctx context.Context, id string) ([]byte, error) {
	req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://pricing.internal/quotes/"+id, nil)
	if err != nil {
		return nil, err
	}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		io.Copy(io.Discard, resp.Body) // drain to EOF so the connection is reused
		return nil, fmt.Errorf("pricing: %s", resp.Status)
	}
	return io.ReadAll(resp.Body)
}

import httpx

# One client per process: it owns the pool. A client per request defeats keep-alive.
client = httpx.Client(
    base_url="https://pricing.internal",
    timeout=httpx.Timeout(5.0, connect=2.0, pool=1.0),
    limits=httpx.Limits(max_connections=100, max_keepalive_connections=20, keepalive_expiry=30),
    http2=True,  # requires: pip install 'httpx[http2]'
)

def get_quote(quote_id: str) -> dict:
    try:
        resp = client.get(f"/quotes/{quote_id}")
        resp.raise_for_status()
        return resp.json()
    except httpx.TimeoutException as exc:  # Connect/Read/Write/PoolTimeout
        raise UpstreamTimeout(type(exc).__name__) from exc

use std::time::Duration;

// Build once and clone freely: Client is an Arc around a shared pool.
pub fn build_client() -> reqwest::Result<reqwest::Client> {
    reqwest::Client::builder()
        .connect_timeout(Duration::from_secs(2))
        .read_timeout(Duration::from_secs(5)) // per read, resets on progress
        .timeout(Duration::from_secs(10))     // whole request including body
        .pool_idle_timeout(Duration::from_secs(60))
        .pool_max_idle_per_host(32)
        .build()
}

pub async fn get_quote(client: &reqwest::Client, id: &str) -> reqwest::Result<String> {
    client
        .get(format!("https://pricing.internal/quotes/{id}"))
        .send()
        .await?
        .error_for_status()?
        .text()
        .await
}

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public final class PricingClient {
    // One client per application: it owns the connection pool.
    private static final HttpClient CLIENT = HttpClient.newBuilder()
            .version(HttpClient.Version.HTTP_2) // default; falls back to HTTP/1.1
            .connectTimeout(Duration.ofSeconds(2))
            .build();

    static String getQuote(String id) throws Exception {
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://pricing.internal/quotes/" + id))
                .timeout(Duration.ofSeconds(5))
                .header("Accept", "application/json")
                .GET()
                .build();
        HttpResponse<String> response = CLIENT.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() != 200) throw new IllegalStateException("pricing " + response.statusCode());
        return response.body();
    }
}

FMT='%{http_version} conns=%{num_connects} dns=%{time_namelookup} tcp=%{time_connect} tls=%{time_appconnect} ttfb=%{time_starttransfer} total=%{time_total}\n'

# Two URLs in one invocation share curl's connection pool:
# the second line should show conns=0 and near-zero tcp/tls.
curl -sS --connect-timeout 2 --max-time 10 -w "$FMT" \
  -o /dev/null https://example.com/ \
  -o /dev/null https://example.com/?again

# Force a protocol to compare (HTTP/3 needs a curl built with QUIC support):
curl -sS --http1.1 -o /dev/null -w "$FMT" https://example.com/
curl -sS --http3 -o /dev/null -w "$FMT" https://example.com/

WHERE IT BITES

• Creating an HTTP client per request. Every call pays DNS, TCP and TLS again, and under load you exhaust ephemeral ports or the upstream's connection limit.
• Relying on default timeouts: fetch and Go's DefaultClient have none, undici waits 300 s for headers, and Java blocks forever without a request timeout. A hung upstream then holds every worker.
• Keeping idle connections longer than the server or load balancer does. The next request lands on a socket the server already closed and fails with a reset; set the client idle timeout below the server's.
• Retrying a timed-out non-idempotent request without an idempotency key. The timeout tells you the client stopped waiting, not that the server did nothing.
• Allowing 0-RTT for state-changing requests. Early data can be replayed, so restrict it to safe, idempotent methods.
• Assuming HTTP/2 removed head-of-line blocking. It removed it at the HTTP layer; on lossy mobile links TCP still stalls every stream, which is the problem HTTP/3 addresses.

WHEN IT BREAKS IN PRODUCTION

• A brief blip turns into a long outage
• A third-party API starts returning 429
• CORS fails only in production or on preflight

SOURCES

• RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 (opens in new tab)Checked 2026-10-07
• RFC 8470: Using Early Data in HTTP (opens in new tab)Checked 2026-10-07
• RFC 9113: HTTP/2 (opens in new tab)Checked 2026-10-07
• RFC 9114: HTTP/3 (opens in new tab)Checked 2026-10-07
• MDN: HTTP caching (opens in new tab)Checked 2026-10-07
• curl man page (--write-out) (opens in new tab)Checked 2026-10-07