Alt-Svc moves HTTP authority to a second endpoint

Alt-Svc moves HTTP authority to a second endpoint An Alt-Svc response tells a client that another endpoint can serve the same origin. The mechanism is common in HTTP/3 deployments, where a website advertises a QUIC service on another port. It also changes where requests travel. That makes the header, the advertised endpoint, and the client's fallback behavior part of the security boundary. RFC 7838 says an alternative service is authoritative for the origin. When a client uses one, it presents the origin's SNI and Host information to that service. The alternative is expected to establish the same security properties as the origin. A header injected into a user-controlled response, an endpoint that accepts a different certificate, or an unsafe fallback can therefore turn a performance feature into traffic redirection or downgrade. Why a second endpoint matters Proxies and gateways often inspect the origin hostname while treating the advertised port as infrastructure detail. A policy that allows the origin on TCP 443 may not describe how the same origin behaves when it is reached through a QUIC listener on another port. Firewall rules, certificate inventories, observability, and request authentication should follow the effective host and service. The RFC's security section warns that an attacker able to inject alternative services and listen at the advertised port can impersonate the origin. The risk is reduced by requirements on how alternatives are associated with an origin, but deployment mistakes can undermine those expectations. The client must negotiate the expected protocol and must regard Alt-Svc as part of the origin's authority, not as permission to route to an arbitrary host. Connection coalescing adds another question. HTTP/2 and HTTP/3 can reuse a connection for multiple origins when the certificate and authority conditions allow it. RFC 8336 defines an ORIGIN frame that lets a server add origins to a connection's origin set. A reverse proxy should know which origins it groups and should not assume that a single upstream connection represents a single tenant. Review the path Inventory Alt-Svc generation at the CDN, reverse proxy, and application layers. Determine which components can set the header and whether user content can influence response headers. Strip backend-generated Alt-Svc headers at an edge that is not prepared to support the advertised service. Restrict who can open the advertised listener. Validate certificate and hostname handling for every alternate endpoint. The service must present a certificate valid for the origin and must reject requests whose authority does not belong to it. Verify that a failed ALPN negotiation is treated as failure, not a silent switch to a weaker transport. If a client policy disallows alternatives for privacy or inspection reasons, confirm that it applies consistently across applications. Check proxy and TLS-inspection behavior. A client configured to use a proxy should route the alternative service through that proxy unless the configuration explicitly allows a direct connection. An inspection appliance that sees HTTP/2 but not QUIC can create a blind spot. The control should be an explicit choice about whether QUIC bypasses inspection, not an accidental consequence of a browser update. Review cache lifetime and deletion behavior. An old advertisement can outlive a migration. Remove stale ports and ensure that decommissioned endpoints no longer receive authoritative requests. Monitor clients that still use retired alternatives. Operational tests From an external network, request the origin and inspect the returned Alt-Svc value. Resolve the endpoint through the same DNS and proxy path a client uses. Check the certificate, ALPN, Host header handling, HTTP/3 support, and fallback behavior. Send requests for a second origin to see whether connection reuse crosses a tenant or service boundary. Test responses to a modified or malformed advertisement. The client should reject an invalid value rather than fall back to an unauthenticated endpoint. Test an endpoint that stops answering. The fallback plan should preserve the origin's required security properties and should be observable. Defensive baseline Treat Alt-Svc as an authority delegation record. Generate it only from trusted configuration, publish only endpoints with matching certificate and routing policy, and keep every such endpoint in the asset inventory. Inspect the same traffic path that clients actually use. When QUIC cannot be inspected or controlled as well as the origin, do not advertise it merely because the server supports it. The goal is not to avoid HTTP/3. It is to make the alternate endpoint carry the same identity, access, and observability rules as the origin it claims to serve. References RFC 7838: HTTP Alternative Services RFC 9110: HTTP Semantics RFC 8336: The ORIGIN HTTP/2 Frame