computer science

Oblivious HTTP

Oblivious HTTP is a computer science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Oblivious HTTP rather than just read about it. In short: Oblivious HTTP (OHTTP) is an IETF network protocol intended to enable anonymous HTTP transactions over the Internet. Its goal is to allow a user to send an HTTP request to a web server without allowing any single entity to see both the content of the request and the sender's IP address, since the IP address could be connected to the identity of the sender.

Key takeaways

Oblivious HTTP belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Oblivious HTTP to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Oblivious HTTP from memory before moving on to harder problems.

Reference excerpt

Oblivious HTTP (OHTTP) is an IETF network protocol intended to enable anonymous HTTP transactions over the Internet. Its goal is to allow a user to send an HTTP request to a web server without allowing any single entity to see both the content of the request and the sender's IP address, since the IP address could be connected to the identity of the sender. OHTTP is documented in RFC 9458, published in January 2024 by authors affiliated with Mozilla and Cloudflare. The RFC says "Oblivious HTTP is simpler and less costly than more robust systems, like Prio or Tor, which can provide stronger guarantees at higher operational costs." Some technology companies and other online service providers have implemented OHTTP to improve Internet privacy for users, typically for specific use cases such as collecting software metrics from client devices, collecting user data for targeted advertising, or processing client requests for use of artificial intelligence services. The privacy protections in the OHTTP protocol rely on two separate entities handling different aspects of each client request, so service providers interested in deploying OHTTP generally partner with a different company. For example, Cloudflare and Fastly provide OHTTP relay services, and Apple, Google, Meta, and Mozilla partner with one or both relay services for their OHTTP implementations.

Mechanism HTTP is the foundation of communication for the World Wide Web. By default, HTTP exposes a website user's IP address to the operator of the website, which may enable the operator to gather a profile of information about the user. OHTTP is one of several protocols designed to protect the privacy of users making requests to web servers, using the principle of privacy partitioning (also called decoupling) to hide IP addresses. OHTTP is designed for simple transactions, such as sending web analytics information, rather than general-purpose web browsing. Most implementations of OHTTP involve an application, such as a mobile app, pre-configured to reach out to an OHTTP service for a particular type of transaction.

OHTTP protects user privacy by combining message encryption and specially-designed proxy servers. First, the client uses hybrid public key encryption (HPKE) to encapsulate the content of a HTTP request. Then, the client sends the encrypted request to a relay, which can collect the client IP address but cannot decrypt the message. The relay forwards the encrypted message to a gateway, which can decrypt the message but cannot find out the client IP address. The gateway sends the decrypted request to a server for processing. All traffic between the source, relay, gateway, and target server is sent over HTTPS to prevent third parties from analysing or intercepting the message contents. Since neither the relay nor gateway knows both the source IP address and the content of a request, the relay and gateway would need to collude to cross-correlate messages and de-anonymize them. If either of the operators is trustworthy, privacy is preserved. However, if both operators collude, they can compromise the privacy guarantees of OHTTP. The gateway and target server are typically operated by the same organization, while the relay is typically operated by a different organization to prevent collusion. An analysis by NCC Group of an OHTTP implementation also noted that, to reduce risk of traffic analysis and other attacks, "Deployment of OHTTP requires careful management of key rotation, rate limiting, and tolerances against network delays." Client applications configured to use OHTTP, such as applications designed to use OHTTP for certain API calls, do not need to try to find out whether OHTTP is available from a server. In other cases, if a server operator wants to tell clients that a service supports OHTTP, RFC 9540 (February 2024) defines an optional DNS resource record parameter. This mechanism enables a client to discover, after sending a DNS request, that they can send OHTTP requests, although the initial DNS request could expose the client's IP address to the server if not otherwise hidden.

Deployments Cloudflare released an OHTTP relay service in 2022, called Privacy Gateway. Flo, an app for tracking menstrual cycles, uses Cloudflare's OHTTP service to offer an "Anonymous Mode" that enables entering data into Flo without providing personally identifying information. Google contracted with Fastly in 2023 to provide Google with an OHTTP relay to implement its experimental anonymous advertising technology. Specifically, Google used OHTTP to help ensure k-anonymity for its Privacy Sandbox initiative. Google also uses a Fastly OHTTP relay as part of its Google Safe Browsing service. Google offers a Safe Browsing Oblivious HTTP Gateway API that enables client applications, such as web browsers, to check whether a URL is on Google's list of unsafe websites without revealing the requester's IP address to Google. In 2023, Mozilla started using Fastly's OHTTP relay service as part of collecting Firefox performance metrics without collecting identifying information about individual users. As of 2024, Apple uses OHTTP in its Private Cloud Compute platform to conceal IP addresses associated with requests to Apple Intelligence tools. Apple published support for OHTTP for its Swift programming language in 2024. Apple said in 2025 that its Enhanced Visual Search uses OHTTP as part of its anonymization strategy. The Internet Security Research Group includes an OHTTP gateway in Divvi Up, a service that enables subscribers to collect software metrics from user devices while collecting minimal identifying information about users. As of 2025, Meta Platforms uses OHTTP in its "Private Processing" functionality for Meta AI tools, including to enable WhatsApp users to request summarization of messages without exposing the requester's IP address to Meta. This uses Fastly's OHTTP relay service.

Related technologies

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Oblivious HTTP

Start with the simplest possible case. Write down what Oblivious HTTP claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Oblivious HTTP before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Oblivious HTTP ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Oblivious HTTP

In research: Oblivious HTTP appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Oblivious HTTP in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Oblivious HTTP is common in secondary-school and first-year university syllabi. It links to neighbouring topics Application layer protocols, Cryptographic protocols, Hypertext Transfer Protocol, so understanding it makes those chapters shorter.
In everyday life: Look for Oblivious HTTP outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Ask Teacher Smith questions about this articleOpens your AI tutor with a question about “Oblivious HTTP” →

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Oblivious HTTP in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Oblivious HTTP means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Oblivious HTTP out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Oblivious HTTP in simple terms?

Why does Oblivious HTTP matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Oblivious HTTP?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Oblivious HTTP.