HTTP 425 Too Early — TLS Early Data Rejected

Overview

HTTP 425 Too Early means the server refuses to process a request sent during TLS 1.3 early data (0-RTT) due to replay attack risk.

Key Details

• Defined in RFC 8470 for TLS 1.3 0-RTT early data
• TLS 1.3 allows sending data before the handshake completes (0-RTT)
• 0-RTT data can be replayed by an attacker, so servers may reject it
• The client should retry the request after the TLS handshake completes
• Only affects non-idempotent requests (POST, PUT) — GET is safe for 0-RTT

Common Causes

• Server configured to reject early data for non-idempotent requests
• CDN or reverse proxy stripping early data for security
• Client sending POST/PUT in TLS 1.3 0-RTT which server rejects
• Server-side anti-replay protection activated

Steps

1. 1The browser automatically retries after full TLS handshake — no user action needed
2. 2If developing a server, return 425 for non-idempotent requests in early data
3. 3For APIs, handle 425 by retrying the request normally
4. 4Configure your TLS server to accept 0-RTT for safe (GET) requests only
5. 5Test early data behavior with openssl s_client -early_data

Tags

More in 4xx Client Error

Frequently Asked Questions