Core Specifications

The “core” semantics of the HTTP protocol are defined by:

• RFC 9110: HTTP Semantics
• RFC 9111: HTTP Caching

Those semantics are expressed “on the wire” in three ways:

• RFC 9112: HTTP/1.1
• RFC 9113: HTTP/2
• RFC 9114: HTTP/3

Later versions of HTTP offer field compression:

• RFC 7541: HPACK Header Compression for HTTP/2
• RFC 9204: QPACK Field Compression for HTTP/3

These RFCs collectively obsolete all preceding RFCs defining HTTP, including RFC 1945, RFC 2068, RFC 2616, RFC 2617, RFC 7230-5, and RFC 7540.

Also relevant is the Structured Field Values specification, which is used in a growing number of headers and trailers:

• RFC 9651: Structured Field Values for HTTP (test suite)

Protocols built “on top” of HTTP should follow Best Current Practice, as documented here:

• RFC 9205: Building Protocols with HTTP

Extension Registries

There are a large number of HTTP extensions, including methods, status codes and headers. It’s important to note that they are all “part of” HTTP, as long as they’re listed in the appropriate registries:

• HTTP Method Registry - more info
• HTTP Status Code Registry - more info
• HTTP Field Name Registry - more info
• HTTP/2 Parameters - Frame types, settings, error codes
• HTTP/3 Parameters - Frame types, settings, error codes

Individual headers have their own registries that regulate permissible values, including:

• HTTP Authentication Scheme Registry - more info
• HTTP Cache Directive Registry - more info
• HTTP Parameters - Content-codings, transfer-codings, Forwarded, Prefer, and Range-related headers

Related Specifications

This is a partial list of HTTP-relevant specifications, here for convenience. For the complete list of HTTP extensions, see the relevant registry.

Methods

• RFC 5789: PATCH Method
• RFC 10008: QUERY Method

Status Codes

• RFC 6585: Status Codes 428, 429, 431 and 511 (Precondition Required, Too Many Requests, Request Header Fields Too Large, Network Authentication Required)
• RFC 7725: Status Code 451 (Unavailable For Legal Reasons)
• RFC 8297: Status Code 103 (Early Hints)

Caching Extensions

• RFC 5861: Cache-Control: stale-while-revalidate and stale-if-error
• RFC 8246: Cache-Control: immutable
• RFC 9211: Cache-Status Header Field
• RFC 9213: Targeted Cache Control Fields
• RFC 9875: HTTP Cache Groups

Content-Related Extensions

• RFC 6265: Cookies
• RFC 6266: Content-Disposition
• RFC 7694: Client Initiated Content-Encoding
• RFC 8144: Prefer Header Field
• RFC 8288: Web Linking
• RFC 8942: HTTP Client Hints
• RFC 9842: Compression Dictionary Transport

Connection and Intermediary Extensions

• RFC 7639: ALPN Header Field
• RFC 7838: Alternative Services
• RFC 8336: ORIGIN HTTP/2 Frame
• RFC 8441: Bootstrapping WebSockets with HTTP/2
• RFC 9209: Proxy-Status Field
• RFC 9218: Extensible Prioritization Scheme for HTTP
• RFC 9220: Bootstrapping WebSockets with HTTP/3
• RFC 9298: Proxying UDP in HTTP
• RFC 9412: Origin HTTP/3 Frame
• RFC 9440: Client-Cert HTTP Header Field
• RFC 10036: Incremental Forwarding of HTTP Messages

Security-Related Extensions

• RFC 7616: HTTP Digest Access Authentication
• RFC 7617: HTTP Basic Authentication
• RFC 8188: Encrypted Content-Encoding
• RFC 8470: Using Early Data in HTTP
• RFC 9421: HTTP Message Signatures (online demo)
• RFC 9530: Digest Fields
• RFC 9729: HTTP Concealed Authentication