The server won’t risk processing a request that might be replayed.
When to use it
TLS early data (0-RTT).
Common causes and fixes
425 relates to TLS 1.3 early data, also called 0-RTT: a returning client may send its request together with the first handshake packet, but an attacker can replay that data. A server or CDN that receives a request with side effects in early data can answer 425, and the client resends it after the handshake completes. Proxies mark such requests with the Early-Data: 1 header.
You rarely handle it yourself, because browsers retry automatically. It matters when you enable 0-RTT, for example ssl_early_data on in nginx: forward the flag with proxy_set_header Early-Data $ssl_early_data, and have the app return 425 for POST requests or any GET that changes state. If you can’t guarantee that, keep 0-RTT switched off.
Client error (4xx)
4xx codes are client errors: the request itself is wrong, unauthorised or points at something that isn’t there. Retrying the same request won’t help.
What it looks like
HTTP/1.1 425 Too EarlyHow to send it
| Node.js / Express | res.status(425).end() |
|---|---|
| Python / Flask | return '', 425 |
| nginx | return 425; |
How to check it
curl -s -o /dev/null -w "%{http_code}\n" https://example.com/