Blog
HTTP/3 and QUIC: do CORS rules change on the wire?
CORS is an HTTP semantic enforced by browsers; QUIC changes transport, not application-level allowlists.
1 min read
http3quiccors
Same policy, different stack
Your origin strings and header names remain identical whether the connection uses HTTP/2 or HTTP/3.
Some CDNs negotiate protocols per client; monitor error rates when rolling out QUIC to a subset of users.
Operational checks
Use browser and curl with Alt-Svc to compare response headers across protocol versions.
Watch for middleboxes that downgrade or strip headers inconsistently between QUIC and TCP paths.