425 Too Early: Preventing Replay Attacks in TLS 1.3
What Is TLS 1.3 Early Data (0‑RTT)?
TLS 1.3 introduced "early data" (also known as 0‑RTT), which reduces latency by allowing a client to send application data immediately after the first TLS handshake message, before the handshake is complete. This can significantly speed up repeated connections.
However, early data is vulnerable to replay attacks — an attacker could intercept and replay the early data to the server. To mitigate this, the server can reject requests that use early data by returning 425 Too Early.
Common Causes of 425 Errors
| Cause | Example | How to Fix |
|---|---|---|
| Server rejects early data | Client sends 0‑RTT early data, but server is configured to reject it. | Client should retry without early data. |
| Replay detection | Server detects that the early data has been replayed. | Client should not reuse the same early data; retry without it. |
| Non‑idempotent request | Client sends a POST request with early data, which could be dangerous if replayed. | Server refuses early data for non‑idempotent methods; client must retry without early data. |
| Server configuration | Server has disabled 0‑RTT for security reasons. | Client must fall back to a full handshake. |
Example: 425 Response
A client attempts a POST request using TLS 1.3 early data, but the server rejects it:
How to Fix 425 Errors
- If you're a client developer: Retry the request without using TLS 1.3 early data. Most HTTP libraries (e.g., curl, browsers) handle this automatically by falling back to a full handshake. Ensure your server supports the
Early-Dataheader or the425status. - If you're a server administrator: Configure your server to reject early data for sensitive operations. In Nginx, you can use
ssl_early_data off;. For other servers, check the documentation. You can also accept early data but use application‑level replay protection. - If you're an end‑user: This error is extremely rare and is typically handled transparently by browsers. If you see it, try refreshing the page.
Server Configuration Examples
Nginx:
Apache (mod_ssl):
Most modern browsers handle 425 by retrying the request without early data, so you may not need to change anything.
Frequently Asked Questions
Is 425 a client error or a server error?
It's a client error (4xx) because the client attempted to use early data, and the server is unwilling to accept it. The client should retry without early data.
Does 425 only apply to TLS 1.3?
Yes, it is specifically defined for TLS 1.3 early data. It is not used in other contexts.
Can I ignore 425 and retry automatically?
Yes, HTTP clients should automatically retry the request without early data when receiving 425. This is the expected behavior.