Keep intermediary retry cases separate
04Whether the received request already carried Early-Data determines when an intermediary must forward a 425 and when it may retry.
For an early received request with no incoming field, retry is MAY. This example waits for the client-side handshake before retrying.
Source for this drawing: RFC 8470 · Read RFC section 5.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Incoming connection
- The gateway’s connection to its client, distinct from its connection to the origin.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
An existing earlier-hop header cannot be cleared by waiting locally.
- An intermediary can always forward a 425 response. It MUST forward it when the request it received and forwarded already contained Early-Data.
- Otherwise, if the intermediary received the request in early data without that field, it MAY automatically retry after a 425, but MUST wait for handshake completion on the connection where it received the request.
- These are distinct cases. The second case is about the received request lacking Early-Data; the gateway may have added the field when first forwarding it. An intermediary MUST NOT introduce early data on forwarding unless it was used on a previous hop or it knows retry is safe.
The diagram compares two independent incoming requests. Header already present: forward 425 to the previous client. Early request with no incoming header: this gateway chooses the permitted retry after its incoming handshake completes, using an established origin connection. Waiting on an origin connection alone does not satisfy the incoming-connection requirement.
Read the RFC section ↗