2026-09-20 · 8 min read
- http
- alt-svc
- networking
HTTP Alternative Services lets an origin advertise another network endpoint, and potentially another protocol, where clients can access the same origin. It can support protocol upgrades and routing changes without replacing the resource URL.
The distinction between origin and connection endpoint is fundamental. The scheme, host, and port of the requested origin continue to govern authority, cookies, authorization, caching, and certificate expectations even when the socket connects elsewhere.
Define the alternative-service contract
Document which origins advertise alternatives, accepted protocol identifiers, endpoint authorities, advertisement lifetime, rollout percentage, and fallback behavior. Generate fields through a standards-aware implementation rather than concatenating quoted values.
- Keep alternatives scoped to the origin that advertised them.
- Require valid authentication for the original origin.
- Treat use of an advertisement as optional.
- Never encode secrets in an alternative authority.
Preserve origin security
The alternative must present credentials acceptable for the original origin under the client's protocol rules. Connecting successfully to the advertised host is insufficient if certificate coverage, server-name handling, or application authority checks do not preserve the original security context.
Keep cookies and authorization attached to origin policy, not to the alternative hostname as if it were a redirect target. Prevent coalescing or shared infrastructure from mixing requests belonging to unrelated origins.
Control persistence and recovery
Clients can remember a valid advertisement for its max-age. Choose a short lifetime during rollout, maintain the alternative throughout the advertised interval, and understand the supported mechanism for clearing an advertisement.
Fallback must produce a correct request to the origin when DNS, TLS, protocol negotiation, connection establishment, or alternative health fails. Bound retries so a dead alternative does not add repeated delay to every request.
Verify the complete delivery path
Record origin emission, CDN or proxy changes, client storage, selected endpoint, negotiated protocol, TLS identity, response authority, fallback, and expiry. Distinguish application response latency from connection racing and remembered client state.
Use Flashman's URL tool for origin fixtures, diff for header captures, timestamp converter for max-age timelines, PEM newline tool for public test certificates, and JSON formatter for sanitized connection traces. Test clearing, expiry, invalid certificates, unreachable endpoints, multiple alternatives, proxy stripping, and origin isolation.