4. Security Considerations

Since transmitting HTTP Datagrams using QUIC DATAGRAM frames requires sending the HTTP/3 SETTINGS_H3_DATAGRAM setting, it "sticks out". In other words, probing clients can learn whether a server supports HTTP Datagrams over QUIC DATAGRAM frames. As some servers might wish to obfuscate the fact that they offer application services that use HTTP Datagrams, it's best for all implementations that support this feature to always send this setting; see Section 2.1.1.

Since use of the Capsule Protocol is restricted to new HTTP upgrade tokens, it is not directly accessible from Web Platform APIs (such as those commonly accessed via JavaScript in web browsers).

Definitions of new HTTP upgrade tokens that use the Capsule Protocol need to include a security analysis that considers the impact of HTTP Datagrams and Capsules in the context of their protocol.

---