Carry the early-data signal across hops
02A gateway marks earlier-hop exposure with Early-Data: 1, even if the next connection has already completed its handshake.
An established origin-side connection does not erase earlier replay exposure. Intermediaries MUST NOT remove the field.
Source for this drawing: RFC 8470 · Read RFC section 5.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Gateway
- An intermediary such as a reverse proxy that forwards requests to an origin.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Preserve the earlier-hop warning rather than clearing it at a new TLS boundary.
- Early-Data has one valid value, 1. It indicates early-data exposure and understanding of 425. An intermediary forwarding before its client-side handshake completes MUST add Early-Data: 1 if absent, and MUST NOT remove an existing Early-Data field. It also MUST use the field if a request might have been replayed and already forwarded by it or another instance.
- Clients MUST include at most one instance. Servers MUST treat multiple or invalid instances as equivalent to one instance with value 1. Early-Data MUST NOT appear in Connection, responses or request trailers.
- The field is not intended for original user agents, which need not add it when sending early requests. Waiting for a downstream handshake cannot make a header-marked earlier-hop request safe; if it cannot be safely processed, the server MUST reject it with 425.
The example gateway knows the origin supports the extension. It receives an early GET without the field, adds Early-Data: 1, and forwards over an already established origin connection. Another intermediary retains the field. The warning is not an authorization credential or proof that the current hop itself used 0-RTT.
Read the RFC section ↗