From 53d43d9386942043c417e27534596def7253dbc4 Mon Sep 17 00:00:00 2001 From: RJ Beers Date: Fri, 3 Jan 2025 17:30:25 -0500 Subject: [PATCH] Correct our support for UDP and HTTP/3 This was missed in prior docs PRs related to UDP and HTTP/3 work. --- content/docs/internals/connection.mdx | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/content/docs/internals/connection.mdx b/content/docs/internals/connection.mdx index 81249f1d3..6912e212c 100644 --- a/content/docs/internals/connection.mdx +++ b/content/docs/internals/connection.mdx @@ -10,21 +10,25 @@ import LongLivedConnections from '@site/content/docs/admonitions/_long-lived-con # Connection Lifecycle -Pomerium enables proxying of HTTP and TCP connections, uniformly applying [access policies](/docs/capabilities/authorization) across these connections. +Pomerium enables proxying of HTTP, TCP, and UDP traffic, uniformly applying [access policies](/docs/capabilities/authorization) across the routed traffic. The primary focus of this document is the management of transport layer connections in Pomerium, particularly HTTP requests. -## HTTP and TCP connection lifecyle +## HTTP connection lifecyle -### 1. **Downstream connection and TLS termination** +TCP and UDP traffic is tunneled over HTTP, so let's focus on the HTTP connection lifecycle. -A client, usually a web browser, initiates a connection to Pomerium. +### 1. **Downstream connection and TLS termination** -- This connection can be HTTP/1.1 or HTTP/2. +- A client, usually a web browser, [Pomerium CLI](/docs/clients/pomerium-cli), or [Pomerium Desktop App](/docs/clients/pomerium-desktop), initiates a connection to Pomerium. This connection can be HTTP/1.1, HTTP/2, or HTTP/3. :::tip **Note** -Pomerium currently does not support QUIC or HTTP/3 transports. Most modern browsers default to HTTP/2 connections for significant performance benefits. In rare circumstances, you may need to force HTTP/1.1 using the [`codec_type`](/docs/reference/codec-type) parameter. +HTTP/2 and HTTP/1.1 are allowed by default, with most modern browsers defaulting to HTTP/2. + +HTTP/3 can be enabled by setting the [`codec_type`](/docs/reference/codec-type) parameter. This is recommended when proxying UDP traffic. + +In rare circumstances, you may need to force HTTP/1.1 using the [`codec_type`](/docs/reference/codec-type) parameter. ::: @@ -34,7 +38,7 @@ Pomerium currently does not support QUIC or HTTP/3 transports. Most modern brows ### 2. **Request initiation** -After the transport layer connection is established, the downstream client sends an HTTP request. The proxy parses this request, matches it against the configuration, and determines the upstream service to which the request should be forwarded. +After TLS handshakes are complete, the downstream client sends an HTTP request. The proxy parses this request, matches it against the configured routes, and determines the upstream service to which the request should be forwarded. ### 3. **Request authorization**