HPACK: the silent killer (feature) of HTTP/2
This really seems like overkill to me. We&#x27;ve made HTTP&#x2F;2 that much more complex to implement (a custom compression and dictionary not used anywhere else) to compress headers. And complexity always leads to fun new vulnerabilities. I guarantee at some point we&#x27;ll see at least a DoS come out of this.<p>I would add that it also consumes more resources to compress these headers (I know huffman is fast; but it&#x27;s not as fast as plaintext), but you can probably cache a good portion of it, and then just encode the per-connection values at the end. Although I&#x27;d be surprised if Cloudflare has nginx doing that.<p>Right now, my domain&#x27;s HTTP header is 192 bytes:<p><pre><code>    Content-Type: text&#x2F;html; charset=utf-8
    Content-Length: 3884
    Connection: keep-alive
    Content-Security-Policy: upgrade-insecure-requests
    X-Content-Type-Options: nosniff
    X-Frame-Options: deny
</code></pre>
And more than half of it is just optional security enhancements.<p>So now I&#x27;m going to compress that header so that it&#x27;s ... what, 100 bytes? Even on my site that&#x27;s incredibly lean and lacks images, it&#x27;s around 20-30 KiB per page of content. Modern web pages now average being larger than the original DOOM video game (2301 KiB.)<p>So we&#x27;re doing all of this to chase roughly a 0.05% reduction in bandwidth per page? We&#x27;re worrying about the spot on the carpet while ignoring the elephant in the room.