A newly proposed extension to the UDP Proxying over HTTP specification introduces a faster, lighter way for proxies to handle QUIC connections, the encrypted transport protocol that increasingly underpins modern web traffic. The change targets a long-standing inefficiency: every proxied QUIC packet has traditionally needed to be wrapped, encrypted again, and sent inside another QUIC connection, a process that burns CPU cycles and shrinks the usable packet size along the way.
The mechanism at the center of this update is the QUIC Connection ID, a identifier that lets a single network path carry multiple QUIC sessions without them being tied to one fixed combination of IP address and port. By making proxies aware of these identifiers, the specification allows a proxy to reuse the same UDP four-tuple - source and destination IP addresses and ports - for several proxied connections at once, rather than opening a new one each time. For readers trying to understand how these privacy-preserving layers actually work in practice, exploring a working proxy or VPN service is often the clearest path; providers that document their protocol support, such as one option available to consumers, can illustrate how these backend improvements eventually surface as faster, more reliable connections. one option
Perhaps the more consequential change is the introduction of a "forwarded" mode alongside the existing "tunnelled" approach. Tunnelled mode, the current default, encrypts and encapsulates every packet twice - once between client and target, and again between client and proxy - which adds overhead and reduces the effective transmission size. Forwarded mode instead assigns dedicated Connection IDs so that short-header QUIC packets can be relayed through a proxy using lightweight transforms, skipping the redundant encryption layer entirely. Long-header packets, used during connection setup, still require full tunnelling under the proposal.
Why Efficiency and Privacy Both Matter Here
The appeal of forwarded mode lies in its balance of performance and protection. It still guarantees that all traffic passes physically through the proxy, that the destination server cannot see the client's real IP address, and that outside observers watching either leg of the connection gain no more insight than they would without a proxy at all. That puts it well ahead of plain cleartext TCP proxying, which cannot support QUIC and offers markedly weaker confidentiality guarantees.
What forwarded mode does not solve is traffic correlation. An adversary capable of observing both the client-to-proxy link and the proxy-to-target link simultaneously could, depending on the specific transform used, potentially link packets across the two segments. This is an inherent limitation of the design rather than an oversight, and the specification is explicit that both clients and proxies retain the ability to disable forwarded mode unilaterally whenever stronger isolation is warranted.
Trade-offs Proxies Will Need to Weigh
Forwarded mode is only defined for HTTP/3 proxies, meaning deployments still running earlier HTTP versions cannot take advantage of it, though QUIC proxies generally remain capable of handling any QUIC version regardless of mode. There is also a subtler cost: packets sent in forwarded mode bypass congestion control between client and proxy, since that layer of processing is precisely what is being skipped for efficiency. Network operators adopting this mode will need to judge whether reduced per-packet overhead is worth sacrificing the more consistent throughput that congestion-controlled tunnelling provides, a decision that will likely vary by use case and network conditions rather than have one universal answer.