# HTTP 425 Too Early — Meaning, Causes & Fixes

> The server won't process a request that might be replayed, because it arrived as TLS early data.

425 relates to TLS 1.3 0-RTT ('early data'), which lets a returning client send its first request before the handshake finishes. Early data can be replayed by an attacker, so servers or CDNs that receive a non-idempotent request that way answer 425, and the client retries once the handshake completes.

- Class: 4xx Client Error
- Retry: Yes — safe to retry
- Cacheable by default: no
- Defined in: [RFC 8470 — Using Early Data in HTTP](https://www.rfc-editor.org/rfc/rfc8470)

## Example response

```http
HTTP/1.1 425 Too Early
Content-Type: application/json
Content-Length: 21

{"error":"Too Early"}
```

## Common causes

- A POST or other non-idempotent request sent as TLS 1.3 early data.
- A CDN with 0-RTT enabled forwarding `Early-Data: 1` to an origin that rejects it.

## How to fix it

1. Clients: retry after the handshake completes — browsers do this automatically.
2. Servers: only accept early data for safe, idempotent requests such as GET.

## Send a 425 from your server

### Express

```
res.status(425).json({ error: "Too Early" });
```

### Next.js route handler

```
return Response.json({ error: "Too Early" }, { status: 425 });
```

### Flask

```
return {"error": "Too Early"}, 425
```

### Go net/http

```
http.Error(w, "Too Early", http.StatusTooEarly)
```

### nginx

```
return 425;
```

## FAQ

### Should I disable 0-RTT to avoid 425?

Not necessarily. 0-RTT speeds up repeat visits; 425 is the safety valve that keeps replay-sensitive requests out of early data.

## Related status codes

- [400 Bad Request](https://www.devkult.com/http/400.md)
- [426 Upgrade Required](https://www.devkult.com/http/426.md)
- [503 Service Unavailable](https://www.devkult.com/http/503.md)

Open the interactive page: https://www.devkult.com/http/425