425 Too Early

The server will not process a request sent as TLS 1.3 early data (0-RTT) because it could be replayed.

425 at a glance

Code: 425
Name: Too Early
Class: 4xx Client error
Status: IANA-registered standard code
Defined in: RFC 8470, Section 5.2
Cacheable by default: No by default. Caches store it only when the response carries explicit freshness (Cache-Control max-age, s-maxage or Expires).

What 425 means

425 Too Early (RFC 8470) protects against replay of TLS 1.3 0-RTT data. Early data saves a round trip but can be replayed by an attacker, so a server or CDN may refuse non-idempotent requests that arrived that way. The client retries after the handshake completes, which browsers do automatically.

What typically causes a 425

Cloudflare 0-RTT is enabled and forwards early-data requests with Early-Data: 1; an origin that considers the request unsafe answers 425.
nginx with ssl_early_data on plus an application check of $ssl_early_data.

Fix it on the server

Only allow 0-RTT for safe, idempotent requests (GET without side effects); return 425 for the rest.

Fix it as a client or visitor

Retry after the TLS handshake completes; standard browsers and libraries do this.

Headers that go with 425

Header	Role
`Early-Data`	Set to 1 by an intermediary that forwarded a request received in early data.

Example response

HTTP/1.1 425 Too Early
Content-Length: 0