HTTP/3 (QUIC) causes browser-only page hangs on Cloudflare-fronted SSR apps — Cloudflare strips origin Alt-Svc, must disable at edge

Problem

A SvelteKit SSR page (~274KB) hung indefinitely in Chrome and Brave — tab spinner never stopped, Chrome became unresponsive. A different user in a different browser also couldn't load the page. Meanwhile curl loaded it in <600ms, headless Chrome (Puppeteer) loaded it fine, and SPA navigation (no SSR round-trip) worked perfectly. The hang affected any full-page load — refreshing, bookmarks, direct URLs — not just a specific user action.

Root cause

The app was behind Cloudflare (via Render's managed CDN), which advertises alt-svc: h3=":443"; ma=86400. Browsers cache this and upgrade to QUIC. A QUIC flow-control stall caused the hang.

Evidence:

• curl (no HTTP/3) used TCP, worked fine
• Fresh headless Chrome (no cached alt-svc) used HTTP/2, worked fine
• Real browsers had cached the alt-svc, used QUIC, hung
• Disabling QUIC in chrome flags, instant load

Diagnosis

1. chrome://flags, search enable-quic, set Disabled, relaunch, test. Loads? QUIC confirmed.
2. chrome://net-internals, QUIC tab: check active QUIC sessions during hang
3. chrome://net-internals, Alt-Svc tab: check cached alt-svc entries
4. If not QUIC: chrome://net-export trace, analyze at netlog-viewer.appspot.com

Why you CANNOT fix this from your origin app

Cloudflare explicitly strips Alt-Svc from all origin responses before injecting its own. From the official Cloudflare HTTP headers docs (developers.cloudflare.com, fundamentals, reference, http-headers):

Cloudflare passes all HTTP headers in the response from the origin server back to the visitor with the exception of: X-Accel-Buffering, X-Accel-Charset, X-Accel-Limit-Rate, X-Accel-Redirect, and Alt-Svc.

Setting Alt-Svc: clear in your app response headers is pointless. Cloudflare strips it and replaces it with h3=":443". Community threads confirm users tried alt-svc: clear from origin and Cloudflare overrode it.

Actual fix

If you control the Cloudflare dashboard: Speed, Settings, Protocol Optimization, HTTP/3, Off.

If behind managed Cloudflare (e.g. Render.com): File a support ticket asking them to disable HTTP/3 for your domain. Render has no user-facing HTTP/3 toggle.

Application-level mitigation: Reduce SSR round-trips. Replace window.location.href (full page reload, SSR) with framework-native data invalidation (SvelteKit invalidate(), Next.js router.refresh(), etc.). This does not fix the underlying QUIC issue but reduces how often users trigger full SSR loads.

Key insight

When curl works but real browsers hang on the same URL, suspect the transport layer. curl typically uses HTTP/2 over TCP; browsers upgrade to QUIC after caching alt-svc. The chrome://flags QUIC toggle is the fastest diagnostic, takes 30 seconds.