Visual RFC.
ALL RFCs / RFC 8470
Read the RFC ↗

RFC 8470 / START HERE

HTTP Early Data, before the details

HTTP means Hypertext Transfer Protocol. TLS means Transport Layer Security; its handshake sets up a protected connection. Early data, or zero round-trip (0-RTT) data, is sent before that handshake completes.

A returning client can use early data when the server has offered it for a future TLS connection. RFC 8470 coordinates these HTTP requests: the Early-Data header carries earlier-hop exposure, and status 425 Too Early asks for a retry outside early data.

Start the guide See the 5 chapters ↓

The idea in one picture

  1. Send an eligible early request

  2. Check replay risk across hops

  3. Retry outside early data if refused

A simplified picture of the idea; the chapters explain the actual mechanisms.

Why it exists

Sending sooner saves handshake waiting time but exposes requests to replay. A gateway and origin need shared signals and consistent policy so one hop does not erase a risk created on another.

A familiar example

A fictional client sends GET /catalog early. The server returns 425 because replay is too risky. The client waits for its handshake and retries without early data; a successful final response is not guaranteed.

Helpful background

You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.

HTTPRFC 9110 · beginner overview ↗TLS 1.3RFC 8446 · beginner overview ↗

What you’ll learn next

Begin with chapter one, or choose a topic.

  1. Early does not mean replay safeA request can arrive before the TLS handshake completes; encryption does not stop an attacker replaying its early ciphertext.
  2. Carry the early-data signal across hopsA gateway marks earlier-hop exposure with Early-Data: 1, even if the next connection has already completed its handshake.
  3. Retry a 425 outside early dataA 425 response refuses the replay risk; a user agent that used early data retries after the handshake, outside early data.
  4. Keep intermediary retry cases separateWhether the received request already carried Early-Data determines when an intermediary must forward a 425 and when it may retry.
  5. Check origin support and consistent policyA gateway needs origin support before forwarding early requests, and server instances must handle replay risk consistently.
Start with chapter one →

This introduction explains RFC 8470 (2018). Read the original RFC ↗