A phone moves from Wi-Fi to cellular. Its source IP address and port change, but a QUIC connection may continue because the protocol identifies connections independently of one network four-tuple.
That does not mean the application session is automatically safe, authorized, or exactly once. QUIC preserves transport state across a validated path change. Product continuity remains an application contract.
What the transport preserves #
QUIC uses connection IDs so packets can remain associated with a connection after an address change. Before sending substantial traffic on a new path, an endpoint validates peer reachability using PATH_CHALLENGE and PATH_RESPONSE. Anti-amplification limits constrain what a server can send to an unvalidated address.
Migration can preserve cryptographic and stream state, avoiding a complete new handshake. The new path still has different latency, loss, maximum packet size, and congestion characteristics. RFC 9002 treats congestion control as path-specific.
old path: client CID <-> Wi-Fi address <-> server
network changes
new path: client CID <-> cellular address <-> server
path validationThe connection survived. A request inside it might still be incomplete or have an ambiguous outcome.
Separate four identities #
- Connection identity associates packets with QUIC transport state.
- User session identity associates requests with an authenticated principal.
- Operation identity deduplicates a business effect.
- Device or client-instance identity may support risk policy and token binding.
None should be silently substituted for another. A connection ID is not an authorization credential. An access token remains subject to expiry, audience, scope, and revocation. A stream identifier is not an idempotency key that survives application retries.
Design the migration boundary #
For read requests, retrying after a path transition is often safe if the caller’s deadline remains. For writes, carry an operation key and make the authoritative side effect converge:
POST /transfers
Authorization: Bearer ...
Idempotency-Key: 5f0e...The server persists the key with the accepted result in the same transactional boundary as the business mutation. A second request receives the stored result or a conflict if its payload differs.
Streaming applications need explicit resume semantics. Record a durable sequence or offset so a reconnect can request after=8412. Transport stream offsets help QUIC deliver bytes within the current connection; they are not a permanent product cursor.
Failure policy #
| Event | System response |
|---|---|
| address changes | validate new path before substantial sending |
| validation fails | keep viable old path or close connection |
| latency jumps | recompute deadline viability; shed stale work |
| write response is lost | resolve using operation identity |
| auth token expires | reauthorize at application layer |
| server instance disappears | resume from durable application offset |
| suspicious repeated migration | apply risk controls without trusting IP as identity |
Observe migration as its own cohort #
Measure path-validation success, migration count, old-to-new RTT delta, post-migration loss, request completion rate, resumed-stream gaps, and authentication failures. Split mobile and desktop cohorts. A globally healthy p95 can conceal a poor handover experience.
Avoid logging raw connection IDs as permanent user identifiers. They are protocol state and can become sensitive correlation data.
Common mistakes #
- Treating client IP as a durable session identity.
- Assuming migration prevents every request retry.
- Reusing transport identifiers as business deduplication keys.
- Ignoring the new path’s congestion and MTU behavior.
- Testing only a clean interface switch, not loss during an active write.
Trade-offs #
Connection migration improves continuity on changing networks but requires more endpoint state and privacy-aware connection-ID management. Disabling migration simplifies some deployments but turns ordinary network changes into reconnects. Aggressive resumption reduces visible interruption while increasing the need for strong application cursors and idempotency.
QUIC can carry continuity across networks. The application must still define what continuity means.