425 Too Early
The server refuses to process a request sent in TLS 1.3 early data, because early data can be replayed by an attacker.
At a glance
- Status code
- 425 Too Early
- Class
- 4xx, client error, the request itself is the problem
- Defined in
- RFC 8470
- Cacheable by default
- no
- Response body
- Optional.
In detail
TLS 1.3 zero round trip resumption lets a client send application data with the handshake. That data is replayable, so it must not carry a non-idempotent request.
A server should return 425 for anything with side effects that arrives in early data, and the client should retry after the handshake completes.
Configure the edge to accept early data only for safe idempotent methods, or disable it for the paths that mutate state.
Examples
HTTP/1.1 425 Too Early
Content-Length: 0Things that catch people out
- The Early-Data header tells the origin the request arrived this way. Without it, an origin behind a terminating proxy cannot tell and cannot protect itself.
- Retrying a 425 without waiting for the handshake will get the same answer.
Try it: HTTP Request Builder
Build a request with any method, headers and body, send it, and read the status line the server returns.
HTTP Request Builder
LOCAL · Browser-OnlyBuild and test HTTP requests with custom headers and body
Authentication
Headers
Generate Code
curl -X GET 'https://api.example.com/endpoint' \
-H 'Content-Type: application/json'Showing a sample URL. Enter your endpoint above to update the snippet.
Related HTTP status codes
All http status codes →400 Bad Request
The server refused the request because it was malformed. The client must change something before retrying, because repeating the same bytes will fail.
429 Too Many Requests
The client has sent too many requests in a given period. The Retry-After header says how long to wait before trying again.
103 Early Hints
An interim response that sends Link headers early so the browser can start preloading assets while the server is still building the real response.
426 Upgrade Required
The server refuses to serve this request over the current protocol and names, in the Upgrade header, what it will accept.
428 Precondition Required
The server requires the request to be conditional, and refuses an unconditional one to prevent a lost update.
431 Request Header Fields Too Large
The request headers are collectively or individually too large. Oversized cookies are the usual cause.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL