Too Early
Indicates that the server is unwilling to risk processing a request that might be replayed.
What it means
The HTTP 425 Too Early response status code indicates that the server is unwilling to risk processing a request that might be replayed.
This is related to TLS 1.3 Early Data (0-RTT), where a client can send an HTTP request in the very first packet of a TLS handshake. While fast, it makes the request vulnerable to a replay attack. If the request isn't idempotent (like a POST), the server rejects it with 425 so the client can retry after the secure handshake is finished.
How it works
- 1The client uses TLS 1.3 0-RTT to send a POST request instantly.
- 2The server sees it is "Early Data" and knows an attacker could have duplicated the packet.
- 3The server rejects it with 425.
- 4The client waits 100ms for the handshake to finish and tries again securely.
Why you're seeing this
- • A non-idempotent request was sent via TLS Early Data.
How to fix it
- • Browsers automatically retry the request after the TLS handshake completes.
Framework Implementations
Nginx
# Handled at the TLS layer ssl_early_data on;
Real-Life Scenarios
Automatically handled by web servers (like Nginx/Cloudflare) configured for TLS 1.3 0-RTT. Application code rarely deals with this.
Preventing Double Charges
A browser uses 0-RTT to submit a credit card payment. An attacker intercepts and replays the packet 5 times. If the server allowed it, the user would be charged 6 times. Instead, the server rejects 0-RTT payments with 425.
HTTP Transaction
1. Client Request
POST /checkout HTTP/1.1 Early-Data: 1
2. Server Response
HTTP/1.1 425 Too Early
SEO Implications
None.