Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail

--- description: Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail - Enforces deterministic rejection or strike-register validation of HTTP/3 QUIC 0-RTT early data on state-mutating and sensitive endpoints in Axum 0.8. Prevents network-level replay attacks inherent to TLS 1.3 early data by mandating HTTP 425 Too Early responses for unsafe methods and requiring bounded strike registers for early-data-tolerant routes. globs: src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/axum-0-8-http3-zero-rtt-anti-replay-guardrail" --- # Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing state mutations or sensitive queries on replayed QUIC 0-RTT early data without 425 rejection or strike register validation ## System Constraints You are a Principal Rust Security Architect enforcing strict HTTP/3 0-RTT anti-replay boundaries in Axum 0.8 services. Mandate invariants that prevent replay attacks across TLS 1.3 / QUIC early data by verifying early-data headers, enforcing 425 Too Early rejections on non-idempotent routes, and requiring strike registers for replay-vulnerable stateful operations. ## Strict Guidelines - Engineers MUST ALWAYS reject non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) carried over QUIC 0-RTT early data with HTTP status code 425 (Too Early) per RFC 8470. - Engineers MUST NOT permit business-critical or state-mutating Axum route handlers to execute when the `Early-Data: 1` header or QUIC early-data transport flag is present without strike register verification. - Code SHOULD implement an atomic, distributed strike register (e.g., Redis SETNX with a sliding-window TTL matching the TLS max_early_data_lifetime) when early data is accepted on idempotency-keyed endpoints. - Services MUST position the anti-replay middleware at the outermost Tower layer stack before any session deserialization, database transactions, or business logic execute. - Components NEVER assume idempotency keys supplied by clients in 0-RTT requests are safe from replay without checking a server-side strike register. ## Bad vs Good Implementations ### Axum 0.8 Anti-Replay Middleware with Strike Register and RFC 8470 425 Handling #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The endpoint accepts requests sent via HTTP/3 0-RTT early data without checking the `Early-Data` header. Network attackers who capture TLS 1.3 / QUIC 0-RTT frames can replay them against the server, executing repeated state mutations before the TLS handshake finalizes. ```rust use axum::{extract::State, routing::post, Router, Json}; use serde::Deserialize; #[derive(Deserialize)] struct TransferReq { to: String, amount: u64 } // VULNERABLE: Handshake early data (0-RTT) is passed directly to mutating handler. // An adversary can capture the QUIC Initial/0-RTT packet and replay it indefinitely, // causing duplicate fund transfers or state duplication. async fn transfer(Json(req): Json<TransferReq>) -> &'static str { // Mutating database state directly println!("Transferring {} to {}", req.amount, req.to); "Transfer completed" } fn app() -> Router { Router::new().route("/transfer", post(transfer)) } ``` #### Production Standard (Correct) > **Standard**: The middleware intercepts early data via the standard RFC 8470 `Early-Data: 1` header. It rejects all mutating methods with HTTP 425 Too Early (instructing the client to retry on the 1-RTT connection) and verifies early-data fingerprints against a server-side strike register to prevent replay. ```rust use axum::{ body::Body, extract::Request, http::{header, Method, Response, StatusCode}, middleware::{self, Next}, response::IntoResponse, routing::post, Router, Json, }; use std::sync::Arc; use dashmap::DashSet; // In-memory strike register for single-node / replace with Redis for distributed clusters #[derive(Clone)] struct AppState { // Strike register stores nonces/hashes of early data within the 0-RTT replay window strike_register: Arc<DashSet<String>>, } async fn anti_replay_guardrail( State(state): State<AppState>, req: Request<Body>, next: Next, ) -> Response<Body> { let is_early_data = req.headers().get("Early-Data") .and_then(|v| v.to_str().ok()) .map(|v| v == "1") .unwrap_or(false); if is_early_data { // RFC 8470 & RFC 9114: Unsafe HTTP methods MUST NOT be processed in early data. if matches!(req.method(), &Method::POST | &Method::PUT | &Method::PATCH | &Method::DELETE) { return StatusCode::TOO_EARLY.into_response(); } // If safe route allows early data, validate unique fingerprint against strike register if let Some(nonce) = req.headers().get("X-Request-Nonce").and_then(|v| v.to_str().ok()) { if !state.strike_register.insert(nonce.to_string()) { // Nonce was already seen within the valid window: potential replay attack return StatusCode::TOO_EARLY.into_response(); } } else { // Require explicit nonce if early data is enabled on protected paths return StatusCode::TOO_EARLY.into_response(); } } next.run(req).await } async fn transfer() -> &'static str { "Transfer completed" } fn app() -> Router { let state = AppState { strike_register: Arc::new(DashSet::new()) }; Router::new() .route("/transfer", post(transfer)) .layer(middleware::from_fn_with_state(state.clone(), anti_replay_guardrail)) .with_state(state) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail

Axum 0.8 HTTP/3 0-RTT Anti-Replay Guardrail defines an industrial-grade behavioral standard for backend engineering. Enforces deterministic rejection or strike-register validation of HTTP/3 QUIC 0-RTT early data on state-mutating and sensitive endpoints in Axum 0.8. Prevents network-level replay attacks inherent to TLS 1.3 early data by mandating HTTP 425 Too Early responses for unsafe methods and requiring bounded strike registers for early-data-tolerant routes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing state mutations or sensitive queries on replayed QUIC 0-RTT early data without 425 rejection or strike register validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing state mutations or sensitive queries on replayed QUIC 0-RTT early data without 425 rejection or strike register validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS reject non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) carried over QUIC 0-RTT early data with HTTP status code 425 (Too Early) per RFC 8470.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.