425 Too Early
4xx client error
The server won't process a request that might be replayed, because it arrived as TLS early data.
425 relates to TLS 1.3 0-RTT ('early data'), which lets a returning client send its first request before the handshake finishes. Early data can be replayed by an attacker, so servers or CDNs that receive a non-idempotent request that way answer 425, and the client retries once the handshake completes.
| Class | 4xx Client Error |
|---|---|
| Retry? | Yes — safe to retry |
| Cacheable by default | No — only with explicit Cache-Control |
| Response body | Allowed |
| Defined in | RFC 8470 — Using Early Data in HTTP |
Example response
HTTP/1.1 425 Too Early
Content-Type: application/json
Content-Length: 21
{"error":"Too Early"}Common causes
- A POST or other non-idempotent request sent as TLS 1.3 early data.
- A CDN with 0-RTT enabled forwarding
Early-Data: 1to an origin that rejects it.
How to fix it
- Clients: retry after the handshake completes — browsers do this automatically.
- Servers: only accept early data for safe, idempotent requests such as GET.
Send a 425 from your server
Express
res.status(425).json({ error: "Too Early" });Next.js route handler
return Response.json({ error: "Too Early" }, { status: 425 });Flask
return {"error": "Too Early"}, 425Go net/http
http.Error(w, "Too Early", http.StatusTooEarly)
nginx
return 425;
Check what a URL returns
Print just the status line from the command line, or check a whole list of URLs at once, with their response headers, in the HTTP Status Checker.
curl -sI https://example.com/your-path | head -n 1
Frequently asked questions
Should I disable 0-RTT to avoid 425?
Not necessarily. 0-RTT speeds up repeat visits; 425 is the safety valve that keeps replay-sensitive requests out of early data.
Related status codes