HTTP 425 — Too Early
HTTP 425
Too Early
The server will not risk processing a request sent in TLS early data, because it could be replayed.
What 425 actually means
TLS 1.3 lets a client send data in the very first flight — "0-RTT" or early data — to save a round trip. The catch is that early data can be captured and replayed by an attacker, which is harmless for a page view and dangerous for a payment. A 425 is the server declining to act on early data for a request that is not safe to repeat, and asking the client to send it again over the fully established connection.
Common causes
- A non-idempotent request sent in TLS 1.3 early data
- A CDN configured to reject 0-RTT for state-changing methods
- Replay protection triggering on a repeated early-data request
If you're just trying to view the page
- Nothing — the client retries automatically over the completed handshake
- If a payment or form submission fails once and works on retry, this may be why, and the retry is the safe behaviour
If it's your site
- Only allow 0-RTT for safe, idempotent requests; reject anything that writes
- Check the `Early-Data: 1` header to detect early data on the origin side
- Cloudflare and other CDNs let you configure 0-RTT per zone; turn it off entirely if replay risk is unacceptable
Reference
- Status code
- 425
- Reason phrase
- Too Early
- Category
- 4xx — Client Error
- Defined in
- RFC 8470 §5.2
Common questions
- What does HTTP 425 mean?
- The server will not risk processing a request sent in TLS early data, because it could be replayed. TLS 1.3 lets a client send data in the very first flight — "0-RTT" or early data — to save a round trip. The catch is that early data can be captured and replayed by an attacker, which is harmless for a page view and dangerous for a payment.
- How do I fix a 425 error?
- Nothing — the client retries automatically over the completed handshake
- Is 425 a client error or a server error?
- 425 is in the 4xx range, which means client error. The request itself was the problem, so retrying it unchanged will usually return the same code.
Related pages
- 404 Not Found The server is reachable and working, but there is nothing at the address you ask
- 403 Forbidden The server understood the request and is refusing to allow it, and logging in wi
- 401 Unauthorized You need to authenticate, and either you did not or your credentials were reject
- 429 Too Many Requests You have sent more requests than the service allows in a given period.
- 400 Bad Request The server could not understand the request because something about it is malfor
- 413 Content Too Large The request body is bigger than the server is willing to accept.
- 422 Unprocessable Content The request is well-formed and understood, but the data in it fails the rules.
- 405 Method Not Allowed The URL exists, but it does not accept the HTTP method you used.
- 409 Conflict The request cannot be completed because it clashes with the current state of the
- 415 Unsupported Media Type The server will not accept the format of the body you sent.
- 408 Request Timeout The server gave up waiting for the client to finish sending its request.
- 410 Gone The resource was deliberately removed and is not coming back, and there is no fo