425
4xx Client ErrorToo Early
The server is unwilling to process a request that might be replayed.
425 Too Early belongs to TLS 1.3 early data (0-RTT), which lets a client send a request during the handshake to save a round trip. The catch is that early data can be replayed by an attacker, so a server answers 425 when it won't risk processing a possibly-replayed request. The client should simply retry once the handshake completes.
What 425 looks like on the wire
POST /api/orders HTTP/1.1 Host: api.example.com Early-Data: 1 HTTP/1.1 425 Too Early
About 4xx Client Error
The request has a problem the client needs to fix, like a bad URL, missing auth, or invalid input.
How to fix 425 Too Early
- Retry the request after the TLS handshake has finished.
- Only send idempotent requests like GET as early data.
- If you control the server or CDN, disable 0-RTT for endpoints with side effects.
Where it's defined
425 Too Early is defined in RFC 8470 §5.2. MDN's 425 reference covers browser behavior and examples.