RFC 7541

HPACK: Header Compression for HTTP/2
Standards Track
May 2015
RFC Library > HTTP & SBI Transport > RFC 7541
Abstract: HPACK is the header compression format for HTTP/2. It efficiently compresses HTTP headers using static and dynamic tables, Huffman coding, and indexed references. HPACK eliminates redundant header transmission in persistent SBI connections.
Canonical source: https://www.rfc-editor.org/rfc/rfc7541  |  IETF Datatracker

1. Introduction

▶

HTTP/1.1 headers are verbose text strings repeated with every request. HPACK compresses headers using a combination of static table (61 common headers), dynamic table (connection-specific), and Huffman coding.

For 5G SBI, HPACK significantly reduces overhead for repetitive headers like Content-Type: application/json, Accept, and custom 3GPP headers (3gpp-Sbi-*) across the persistent HTTP/2 connection.

2. Compression Mechanisms

▶
Mechanism Description Compression Ratio
Static Table 61 pre-defined common headers (e.g., :method GET, :status 200) Header index = 1 byte
Dynamic Table Connection-specific learned headers added during session Header index = 1 byte
Huffman Coding Variable-length encoding for literal values ~80% of original size
Literal without indexing Header sent but not added to dynamic table Minimal for sensitive headers
Never indexed Header explicitly excluded from compression (sensitive data) No compression applied

3. Static Table (Selected Entries)

▶
Index Header Name Header Value
1 :authority —
2 :method GET
3 :method POST
4 :path /
8 :status 200
14 :status 500
31 content-type —
58 user-agent —

4. Security Considerations

▶
  • HPACK is designed to be safe against compression side-channel attacks (unlike DEFLATE/CRIME)
  • Sensitive headers (Authorization, Cookie) should use 'never indexed' representation
  • Dynamic table size is bounded by SETTINGS_HEADER_TABLE_SIZE to prevent memory exhaustion
  • HPACK state is per-connection — table is not shared across connections