425 Too Early

Meaning & Description

Common Causes

• The client sent a state-changing POST request using TLS Early Data.
• The server is configured to reject all 0-RTT traffic for sensitive API endpoints.
• A proxy between the client and server forwarded a 0-RTT request that the backend deemed unsafe.

How to fix a 425 error

1. If you are writing a client, ensure your HTTP library handles 425 by automatically retrying the request without the Early-Data header.
2. If you are configuring a server, ensure idempotency for endpoints accepting Early Data, or configure the reverse proxy to automatically return 425 for non-GET requests.
3. Check for the presence of the `Early-Data: 1` header in incoming requests.
4. Disable 0-RTT on the server if your application architecture cannot handle replay attacks safely.

Browser & SEO Behaviour

Code Examples

POST /api/transfer HTTP/1.1
Host: api.example.com
Early-Data: 1
Content-Type: application/json

{"amount": 1000}

app.post('/api/transfer', (req, res) => {
  if (req.headers['early-data'] === '1') {
    return res.status(425).send("Too Early: Request might be replayed");
  }
  // Process transfer safely
  res.send("Transfer complete");
});

@app.post("/api/checkout")
def checkout(request: Request):
    if request.headers.get("Early-Data") == "1":
        raise HTTPException(status_code=425, detail="Too Early")
    return {"status": "Processing"}

func checkoutHandler(w http.ResponseWriter, r *http.Request) {
    if r.Header.Get("Early-Data") == "1" && r.Method != "GET" {
        http.Error(w, "Too Early", 425)
        return
    }
    w.WriteHeader(http.StatusOK)
}

[HttpPost("checkout")]
public IActionResult Checkout() {
    if (Request.Headers.TryGetValue("Early-Data", out var earlyData) && earlyData == "1") {
        return StatusCode(425, "Too Early to process safely.");
    }
    return Ok();
}

curl -X POST https://api.example.com/data \
  -H "Early-Data: 1" \
  -d '{"action":"buy"}' \
  -i

Raw HTTP Response Example

HTTP/1.1 425 Too Early
Content-Type: text/plain
Content-Length: 46

Too Early: TLS 0-RTT replay protection active.

Real-world Examples

Frequently Asked Questions

Developer Tips

• Rely on your reverse proxy (Nginx, HAProxy, Cloudflare) to handle 0-RTT and 425 responses so your application code doesn't have to worry about TLS specifics.
• If you must handle it in application logic, look for the 'Early-Data: 1' header and return 425 immediately for any non-idempotent operation.
• Ensure your APIs are properly RESTful. If a GET request changes state, 0-RTT could cause unintended side effects during replay.

Interview Questions

These are questions you might face in a backend or API design interview that touch on HTTP 425.