What is TLS early data?
A TLS 1.3 feature that lets a returning client send its first request with the resumed handshake. It saves time but can be replayed by an attacker, so it is unsafe for non-idempotent requests.
HTTP 425 TOO EARLY
The server will not risk processing a request that could be replayed from TLS early data. 425 belongs to the 4xx client error class and is defined in RFC 8470.
Loading the workbench.
About HTTP 425
What Does HTTP 425 Too Early Mean?
The server will not risk processing a request that could be replayed from TLS early data. The code is registered with IANA and defined in RFC 8470.
Client error: the request has a problem, so it cannot be fulfilled as sent. Every code from 400 to 499 shares that general meaning, so a client that does not recognise 425 must treat it like 400.
When Do You See a 425 Response?
425 Too Early relates to TLS 1.3 early data, also called 0-RTT. When a client resumes a TLS session, it may send a request before the handshake finishes, which saves a round trip but allows an attacker to replay that request. A server or CDN that receives a replay-sensitive request, such as a payment POST, in early data can answer 425 instead of processing it. Proxies mark such requests with Early-Data: 1.
How Do You Fix a 425?
Clients should simply retry the request after the TLS handshake has completed, which browsers do automatically. Server operators should enable 0-RTT only for idempotent requests such as GET, or make sure the application checks the Early-Data header before acting on anything with side effects. Ordinary applications rarely need to emit 425 themselves; the TLS terminator usually handles it.
What Does a 425 Response Look Like?
HTTP/1.1 425 Too Early
Content-Length: 0
Connection: close425 is not cacheable by default: a browser or CDN stores it only when Cache-Control or Expires explicitly allows it.
To inspect a real one without sending it anywhere:
- Copy the response headers from your browser Network tab, or from
curl -i. - Paste them into the Header decoder to see every header explained.
- Check caching in the Cache lane.
Which Status Codes Are Related to 425?
- 408 Request Timeout: The client took too long to send the request.
- 503 Service Unavailable: Overloaded or down for maintenance. Retry-After may say when it will return.
- 400 Bad Request: The request is malformed: bad syntax, invalid framing, or an unreadable body.
Browse every code on the HTTP status codes page.
What Other Lanes Are in the Reference Section?
- HTTP status codes: Every IANA-registered status code, with a page per code.
- MIME types: File extensions to Content-Type, searchable both ways, plus a Content-Type parser.
- HTTP methods: GET, POST, PUT, PATCH, DELETE and the rest: safe, idempotent, cacheable.
Elsewhere in 2http: Header decoder, Cookie decoder, Cache-Control decoder, CORS checker, User-agent parser, and all eleven lanes on the 2http home page. Part of the 2suite.io privacy-first ecosystem.
Frequently Asked Questions
Do I need to handle 425 in my client?
Browsers retry automatically. Custom clients using 0-RTT should resend the request once the TLS handshake is complete, this time without early data, and it will be processed normally.
Is HTTP 425 an error?
Yes. 425 is a client error response: the problem is in the request, so repeating it unchanged will usually fail again.
Is a 425 response cacheable by default?
No. Caches store a 425 only when Cache-Control or Expires explicitly allows it.
How Can You Verify That Nothing Leaves This Browser?
You do not have to take our word that your headers stay here. Developer tools show every request a page makes, so you can watch this page work and confirm that nothing is sent. The check takes under a minute.
- Open your browser developer tools with
F12, orCmd+Option+Ion a Mac, and select the Network tab. - Reload the page and let it finish. You will see the page's own files, its web fonts, and one anonymous page-view request. Nothing has been typed yet, so none of them can contain your headers.
- Click the clear icon in the Network tab so that the log is empty.
- Paste real headers into any lane and read the result.
- Look at the Network tab again. It is still empty. For extra proof, turn on offline mode after the page loads and every lane keeps working.
Only two things can add a line to that log, and neither carries your headers. Submitting the feedback form sends the vote and comment you typed. Typing characters in a script the page has not displayed yet, such as Cyrillic or Greek, can make the browser fetch the matching font file, and that request names only the font.
2http never sends a request on your behalf: the request builder writes code for you to run, and the meta inspector reads source you paste instead of fetching a URL. The production site also sends a Content-Security-Policy header that tells your browser to refuse connections to anywhere except this site and the anonymous analytics endpoint.