HTTP/2 Connection Coalescing
Connection coalescing lets a browser reuse one HTTP/2 connection for multiple origins when they resolve to the same IP and share a certificate covering both names, collapsing connection counts.
Definition
Coalescing reuses an established HTTP/2 or HTTP/3 connection for requests to a different origin when the DNS answers overlap and the presented certificate is valid for the alternate name. The browser then skips a fresh handshake, TLS session setup, and congestion-window ramp for that origin.
Context and scope
Common when api.example.com and www.example.com sit behind one CDN IP with a SAN certificate. Also the mechanism behind HTTP/3 migration across Alt-Svc endpoints for related hosts.
Common misconceptions
- Coalescing requires the same domain — it works across different origins under one certificate
- It activates whenever IPs match — the certificate must also cover both hostnames or coalescing is refused
- Coalescing needs HTTP/2 — Alt-Svc based coalescing extends the concept to HTTP/3 endpoints
Anti-patterns
- Serving a certificate that omits a SAN entry for a sibling host and breaking silent coalescing gains
- Splitting sibling origins onto different CDN IPs and wondering why connection counts doubled
- Assuming requests to a coalesced origin are same-origin — CORS and cookie scope still apply fully
Related concepts
Related examples
Authoritative source
https://developer.mozilla.org/en-US/docs/Glossary/Connection_coalescing
What it is
Opening a TLS connection per origin is wasteful when several hostnames terminate at the same server. Coalescing folds those origins into one connection: the browser checks that the target resolves to the same address and that the certificate covers the requested name, then multiplexes requests for both origins.
How it works
After connecting to origin A, a request to origin B with the same DNS answer and a cert valid for B reuses the connection. The browser still applies origin-based security: cookies, CORS, and cache partitioning treat the origins as distinct. In HTTP/3, Alt-Svc can point sibling hosts at one QUIC endpoint for the same effect.
When to use it
Architects placing API, app, and static hosts behind one CDN front door get coalescing almost for free with a wildcard or SAN certificate. It reduces handshake latency on mobile and cuts server-side connection state.
Pitfalls
Changing DNS so origins no longer share an IP silently disables coalescing, and the regression is easy to miss. A certificate that lacks a hostname breaks the check even when the IP matches. Origin-scoped state such as cookies is unaffected — coalescing is transport-level only, never a security boundary.