HTTP/2, HTTP/3 and QUIC

HTTP/2#

HTTP/2 is always on, on every platform. There is no setting for it.

The version a connection uses is agreed between your app and the server while they set up the connection. WireLens offers HTTP/2 and HTTP/1.1 to your app, uses whichever it picks, and does the same towards the server. Every flow shows the version that was actually used: in the Protocol row of the inspector's Summary on the Mac, and on the Overview tab on iPhone and Android.

When the two sides disagree, for example your app speaks HTTP/2 but the server only answers HTTP/1.1, WireLens bridges them and records what really happened on each side. The server side is the Upstream protocol row on the Mac and HTTP (origin) on iPhone.

gRPC needs HTTP/2 all the way to the server, and WireLens speaks it. See gRPC, GraphQL and Protobuf.

HTTP/1.1#

HTTP/1.1 is captured and decrypted as you would expect, including connections that carry many requests, chunked bodies and upgrades to WebSocket.

HTTP/3 and QUIC#

HTTP/3 runs over QUIC, which uses UDP instead of TCP. Browsers and many apps try it first when a server offers it.

By default WireLens drops QUIC. Clients fall back to HTTP/2 or HTTP/1.1 over TCP, and WireLens captures and decrypts them like everything else. There is nothing to set up.

Decrypt HTTP/3 (experimental)#

To see HTTP/3 itself, turn on Decrypt HTTP/3 (Experimental). It needs WireLens Pro.

With it on, HTTP/3 to hosts on your SSL Proxying list is decrypted in place. Rules, breakpoints and scripts work on it the same way they do on HTTP/2. QUIC to hosts that are not on the list goes to the server untouched and is not decrypted.

Turn the switch off to go back to the default.

On iPhone and iPad#

With the switch on, apps keep the protocol they chose. A host that pins its certificate is dropped back to TCP automatically.

On Android#

With the switch on, HTTP/3 to hosts on the SSL Proxying list stays HTTP/3 to the server when the server answers QUIC. Other QUIC passes through unread. With it off, the dropped QUIC attempts still show in Traffic.

On the Mac#

With the system proxy, decrypting HTTP/3 needs the WireLens Helper (see Install on Mac). While capture runs, hosts on the SSL Proxying list skip the system proxy and go through a network interface that WireLens adds. Their DNS answers also lose the encrypted ClientHello key, which keeps the host name readable in the browser's first message.

Which clients use HTTP/3 through WireLens depends on how the Mac is captured:

• With the system proxy (Set as the macOS system proxy in Settings ▸ Capture), Safari and most Mac apps turn QUIC off whenever a system proxy is set. They use HTTP/2, which WireLens decrypts.
• With the Network Extension, Safari keeps HTTP/3 and WireLens decrypts it.
• Chrome and other Chromium browsers fall back to HTTP/2 through WireLens in both cases. That traffic is still decrypted.