Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing

--- description: Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing - Enforces transport and application-layer defenses against QUIC 0-RTT replay attacks on state-mutating HTTP/3 routes in Axum 0.8. Non-idempotent methods (POST, PUT, PATCH, DELETE) received during 0-RTT handshakes must be rejected with HTTP 425 Too Early or gated by anti-replay middleware to protect transactional state. globs: src/**/*.rs, crates/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/axum-http3-quic-0rtt-anti-replay" --- # Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Permitting State-Mutating 0-RTT Early Data over QUIC Handshakes Without Replay Fencing ## System Constraints You are a Principal Systems & Security Architect specializing in Axum 0.8, Quinn, and HTTP/3 protocol mechanics. Your mandate is to enforce absolute state fencing against QUIC 0-RTT replay vulnerabilities. RFC 9114 Section 5.2.4 and RFC 8470 prohibit non-idempotent operations in 0-RTT early data without application-level anti-replay protections. Enforce strict rejection via HTTP 425 Too Early on mutating endpoints or disable 0-RTT on the underlying QUIC transport unless explicit cryptographic single-use nonces and replay caches are active. ## Strict Guidelines - Engineers MUST ALWAYS inspect QUIC connection extensions or HTTP 'Early-Data' headers when processing requests in HTTP/3 Axum 0.8 pipelines. - Engineers MUST NOT permit non-idempotent methods (POST, PUT, PATCH, DELETE) to execute against business state when early data is detected on the request context. - Middleware MUST intercept unsafe requests arriving via 0-RTT early data and immediately return StatusCode::TOO_EARLY (425) before running any database or business logic. - Transport configurations in Quinn or s2n-quic SHOULD explicitly disable max_early_data_size on edge nodes unless read-only idempotent routing is enforced at the network boundary. - Idempotent GET/HEAD requests delivered over 0-RTT MUST NEVER induce secondary side-effects or mutate persistent application state. ## Bad vs Good Implementations ### Naive Axum Route Allowing 0-RTT Replays on Mutating Endpoint #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler does not inspect transport metadata or the `Early-Data` flag. In HTTP/3, QUIC 0-RTT packets are sent prior to TLS 1.3 handshake completion and lack forward secrecy, allowing network eavesdroppers to replay the request and execute duplicate financial debits. ```rust use axum::{routing::post, Json, Router}; use serde::Deserialize; #[derive(Deserialize)] struct TransferRequest { recipient: String, amount: u64, } // ANTI-PATTERN: Blindly executing non-idempotent state mutations over HTTP/3 // without validating whether the payload arrived via QUIC 0-RTT Early Data. // An adversary can capture and replay this 0-RTT packet to duplicate transfers. async fn execute_transfer(Json(payload): Json<TransferRequest>) -> &'static str { // State mutation without anti-replay protection database::debit_balance(&payload.recipient, payload.amount).await; "Transfer initiated" } pub fn app() -> Router { Router::new().route("/api/v1/transfers", post(execute_transfer)) } ``` #### Production Standard (Correct) > **Standard**: The middleware intercepts requests before route handlers execute. If the request was received as QUIC 0-RTT early data and uses a mutating HTTP method, it immediately returns `425 Too Early`. This instructs the client to retry the request over the established 1-RTT connection, completely eliminating replay risks. ```rust use axum::{ extract::Request, http::{Method, StatusCode}, middleware::{from_fn, Next}, response::{IntoResponse, Response}, routing::post, Json, Router, }; use serde::Deserialize; #[derive(Clone, Copy, Debug, PartialEq, Eq)] pub struct IsEarlyData(pub bool); // Invariant Guardrail: Reject non-safe HTTP methods when delivered via 0-RTT pub async fn reject_0rtt_on_unsafe_methods( req: Request, next: Next, ) -> Result<Response, StatusCode> { let is_early = req .extensions() .get::<IsEarlyData>() .map(|e| e.0) .unwrap_or(false) || req.headers().contains_key("early-data"); if is_early && !matches!(*req.method(), Method::GET | Method::HEAD | Method::OPTIONS) { // RFC 8470 / RFC 9114 compliance: client must retry over 1-RTT handshake return Err(StatusCode::TOO_EARLY); } Ok(next.run(req).await) } #[derive(Deserialize)] struct TransferRequest { recipient: String, amount: u64, } async fn execute_transfer(Json(payload): Json<TransferRequest>) -> impl IntoResponse { database::debit_balance(&payload.recipient, payload.amount).await; (StatusCode::OK, "Transfer initiated") } pub fn app() -> Router { Router::new() .route("/api/v1/transfers", post(execute_transfer)) .layer(from_fn(reject_0rtt_on_unsafe_methods)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing

Axum 0.8 HTTP/3 QUIC 0-RTT Anti-Replay State Fencing defines an industrial-grade behavioral standard for backend engineering. Enforces transport and application-layer defenses against QUIC 0-RTT replay attacks on state-mutating HTTP/3 routes in Axum 0.8. Non-idempotent methods (POST, PUT, PATCH, DELETE) received during 0-RTT handshakes must be rejected with HTTP 425 Too Early or gated by anti-replay middleware to protect transactional state. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting State-Mutating 0-RTT Early Data over QUIC Handshakes Without Replay Fencing Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting State-Mutating 0-RTT Early Data over QUIC Handshakes Without Replay Fencing	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect QUIC connection extensions or HTTP 'Early-Data' headers when processing requests in HTTP/3 Axum 0.8 pipelines.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.