HTTP Status Codes

425 Too Early

The server refuses to process a request sent as TLS 1.3 early data (0-RTT) because it could be replayed by an attacker.

What it means

425 Too Early (RFC 8470) protects against replay attacks on TLS 1.3 0-RTT early data. Because early data can be replayed, a server may refuse non-idempotent requests sent in it and ask the client to retry once the handshake is fully established.

Why it matters

  • It lets servers enjoy 0-RTT latency wins without exposing sensitive actions to replay.

Common mistakes

  • Sending non-idempotent requests as 0-RTT early data and not handling the 425 retry.

How WebInspect checks this

  • WebInspect reports TLS version and 0-RTT-relevant handshake details.