Web browsing protocols are currently gaining the interest of the researchers. Indeed, HTTP/2, an improvement of HTTP/1.1 has been standardized in 2015 and meanwhile, Google proposed another transport protocol, QUIC (Quick UDP Internet Connection). The main objective of the two protocols is to improve end-users quality of experience and communications security. Current HTTP/2-based web servers rely on the standardized TLS (Transport Layer Security) protocol, on top of TCP. Google has developed its own security system, natively integrated within QUIC, and runs on top of UDP. If performance issues, comparing HTTP/2 over TLS/TCP and QUIC/UDP, have been investigated by few researchers, no one studied the security aspects of the two transport protocols. This paper aims at filling this gap and proposes a first security analysis of TLS/TCP and QUIC/UDP. Based on their characteristics, this paper identifies the vulnerabilities of the two protocols and evaluates their impacts on HTTP/2-based web services. This study can enable web servers developers or administrators to either select TLS/TCP or QUIC/UDP.