Can we run HTTP/2 without using HTTPS?

Yes, we can, but it is not recommended for production.

HTTP/2 can operate over TCP both in unencrypted form (cleartext HTTP/2) and encrypted form (HTTP/2 over TLS).

The main reasons why cleartext HTTP/2 is rare and not recommended:

1. Browser compatibility: Most modern browsers (Chrome, Firefox, Edge, etc.) support HTTP/2 only over TLS. This is because existing infrastructure (intermediate proxies, firewalls) may not handle HTTP/2 without TLS correctly, using old protocol negotiation mechanisms (like the Upgrade header). Transitioning to HTTP/2 over TLS (via ALPN) is more reliable.
2. Security: HTTP/2, like HTTP/1.1, is susceptible to "Man-in-the-Middle" attacks. TLS provides data integrity and confidentiality.
3. Standardization: Although the HTTP/2 standard (RFC 7540) describes both options, de facto, the implementation over TLS has become the standard.

Technically, to run cleartext HTTP/2 on a Node.js server, you can use modules that support this functionality (for example, the built-in http2 with the allowHTTP1 option or third-party libraries if lower-level control is needed).

Example of a minimal Node.js server with cleartext HTTP/2:

const http2 = require('http2');

const server = http2.createServer(); // Creates a cleartext HTTP/2 server by default

server.on('stream', (stream, headers) => {
  // Handle incoming HTTP/2 stream

  stream.respond({
    ':status': 200,
    'content-type': 'text/plain',
  });

  stream.end('Hello, this is cleartext HTTP/2!');
});

server.listen(8080, () => {
  console.log('Cleartext HTTP/2 server running on port 8080');
});

However, such a server will not be accessible via HTTP/2 from most standard browsers without additional configurations (like forcing h2c usage through special tools or non-standard software).

In production, always use HTTP/2 over TLS (HTTPS) for compatibility, security, and reliable protocol negotiation with clients.