What is TLS early data?

TLS 1.3 early data (0-RTT) allows the client to send data during the TLS handshake to reduce latency. However, this data can potentially be replayed.

How do I fix a 425 error?

Retry the request after the full TLS handshake completes. Avoid sending state-changing requests as 0-RTT early data.

HTTP 425 Too Early — What It Means & How to Fix It

Error4xx client error

Overview

The HTTP 425 Too Early status code indicates the server is unwilling to process the request because it might be replayed, typically in the context of TLS early data.

Key Details

This status code was introduced in RFC 8470 for TLS 1.3 early data (0-RTT).
Early data can be replayed by attackers, so servers may reject it for sensitive operations.
The client should retry the request after the TLS handshake is complete.
It protects against replay attacks on non-idempotent operations.

Common Causes

The request was sent as TLS 1.3 early data (0-RTT) and the server considers it risky.
A non-idempotent request was sent before the full TLS handshake completed.
The server policy rejects early data for this endpoint to prevent replay attacks.

Steps

1Retry the request after the full TLS handshake is complete.
2Do not send sensitive or non-idempotent requests as early data.
3Configure your client to avoid sending 0-RTT data for state-changing operations.
4Check server configuration for early data policies.