HTTP/2 and TLS
1. The Core Question
So, you're wondering if HTTP/2, the faster, more efficient successor to HTTP/1.1, needs TLS (Transport Layer Security)? It's a fair question, and the answer isn't as straightforward as a simple "yes" or "no." Technically, the HTTP/2 specification doesn't strictly mandate TLS. But, and this is a big but, the practical reality is quite different. Think of it like this: you can theoretically drive a car without seatbelts, but you probably shouldn't. It's all about weighing the risks and benefits.
In the early days of HTTP/2 development, there was more debate about this. Some argued that forcing TLS would hinder adoption, as it adds overhead in terms of processing power and certificate management. Others felt strongly that the performance benefits of HTTP/2 were so significant that the added security of TLS was a worthwhile trade-off. The end result was a specification that allows for non-TLS implementations, but with a very strong nudge towards using TLS.
Here's where it gets interesting: almost all browsers — the gatekeepers of the web experience — only support HTTP/2 over TLS. This is a de facto requirement. They've made the decision that the security advantages outweigh any potential downsides. So, while technically, an HTTP/2 server could be set up without TLS, it would be effectively useless for most users browsing the web. No browser, no traffic, no party. Right?
Consider this analogy: imagine you've invented a revolutionary new type of electrical outlet that's far more efficient. However, nobody manufactures plugs that fit it, and all existing devices use the old standard. While your outlet might be technically superior, it's practically unusable until adapters are created and adopted. Similarly, HTTP/2 without TLS is like that amazing outlet with no compatible plugs. The browsers are the plugs. They've collectively chosen to only plug into the secure version.
