HTTP 425 Too Early indicates the server is unwilling to risk processing a request that might be replayed. This is used with TLS 1.3 Early Data (0-RTT) to prevent replay attacks on non-idempotent requests.
Status
425 Too EarlyExample
Request
GET /page HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html
Early-Data: 1Response
HTTP/1.1 425 Too Early
Content-Type: text/html; charset=utf-8
<!doctype html>
<html>
<body>
<h1>425 Too Early</h1>
<p>Your request arrived too early. Please wait a moment and try again.</p>
</body>
</html>How to Troubleshoot
1
Retry the request normally
The client should retry the request after the TLS handshake completes (not in early data).
2
Disable early data for sensitive endpoints
Configure the server to reject 0-RTT data for endpoints that perform state-changing operations.
Common Causes
TLS 1.3 Early Data rejection
highThe server received the request in TLS 1.3 0-RTT early data and refuses to process it due to replay risk.
Related Status Codes
References
| Specification | Section |
|---|---|
| Using Early Data in HTTP | RFC 8470 §5.2 |
Frequently Asked Questions
This reference was compiled from official RFCs, protocol specifications, and hands-on troubleshooting experience. AI tools were used primarily for formatting and organizing the content on the page.