AgentRules.org
RulesStacksClientsAuditorPrunerSelf-HealRFCsBenchmarkCLICI/CDAuthorsSubmit
This specification is maintained by the AgentRules Working Group. Have enhancements or want to claim maintainership?Submit Specification →
devopscritical PriorityID: envoy-http3-quic-early-data-anti-replay-standard

Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail

Enforces strict anti-replay mitigations for Envoy HTTP/3 QUIC 0-RTT early data before requests propagate to upstream services. Mandates RFC 8470 compliance, route-level early data policies restricting early frames to idempotent methods, and automated HTTP 425 (Too Early) rejections for unvalidated or mutable actions.

Prohibited Anti-Pattern: Blindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 Validation

Export Ready-to-Drop Configuration

Select format below to copy code or download file directly.

---
description: Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail - Enforces strict anti-replay mitigations for Envoy HTTP/3 QUIC 0-RTT early data before requests propagate to upstream services. Mandates RFC 8470 compliance, route-level early data policies restricting early frames to idempotent methods, and automated HTTP 425 (Too Early) rejections for unvalidated or mutable actions.
globs: infra/**/*.{ts,tsx,js}, deploy/**/*.{ts,yaml,json}, **/envoy/**/*.{ts,yaml,json}, **/control-plane/**/*.{ts,go}
alwaysApply: true
verified_by: "agentrules.org"
license: "CC-BY-4.0"
source: "https://agentrules.org/rules/envoy-http3-quic-early-data-anti-replay-standard"
---

# Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail

> **Severity**: CRITICAL | **Category**: devops
> **Anti-Pattern Warning**: Blindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 Validation

## System Constraints
You are a Principal DevOps and Network Security Architect enforcing Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Mitigation Standards. You must prevent distributed replay attacks on 0-RTT early data by strictly enforcing RFC 8470 semantics, ensuring TLS ticket age validation, restricting early data to safe/idempotent HTTP methods (GET, HEAD, OPTIONS), and configuring Envoy early data policies to return HTTP 425 (Too Early) or buffer requests for handshake finalization when replay risk is present.

## Strict Guidelines
- Engineers MUST ALWAYS restrict HTTP/3 QUIC 0-RTT early data to safe, idempotent HTTP methods (GET, HEAD, OPTIONS) in Envoy route configurations.
- Engineers MUST NOT permit non-idempotent verbs (POST, PUT, PATCH, DELETE) to execute in 0-RTT early data frames without handshake completion.
- Services MUST emit an HTTP 425 (Too Early) status code when an unvalidated 0-RTT request arrives on an endpoint requiring anti-replay guarantees, instructing the client to retry over the confirmed 1-RTT connection.
- Components NEVER accept early data if downstream TLS session ticket age skew exceeds the configured tolerance window.
- Envoy configurations SHOULD enable `envoy.route.early_data_policy.default` with explicit safe-method validation and set the upstream `Early-Data` header in compliance with RFC 8470.

## Bad vs Good Implementations
### Envoy Route and Listener 0-RTT Configuration

#### Bad Antipattern (AI Common Hallucination)
> **Why it fails**: The route configuration permits HTTP/3 0-RTT requests on all routes without setting an `early_data_policy`. Malicious actors capturing QUIC Initial and 0-RTT frames can replay mutating requests (e.g., payment submissions, state mutations) against upstream microservices before handshake finalization.
```typescript
import { RouteConfiguration, Listener } from '@envoyproxy/envoy-definitions';

// ANTI-PATTERN: Blindly enabling 0-RTT without early data policy or method restrictions
export const createVulnerableRoute = (): RouteConfiguration => ({
  name: 'api_routes',
  virtual_hosts: [{
    name: 'api_vhost',
    domains: ['api.enterprise.internal'],
    routes: [{
      match: { prefix: '/v1/' },
      route: {
        cluster: 'upstream_microservice',
        // Vulnerable: Permitting early data indiscriminately allows
        // replayed POST/PUT requests to execute side-effects multiple times
        auto_host_rewrite: true
      }
    }]
  }]
});
```

#### Production Standard (Correct)
> **Standard**: Enforces deterministic early data validation. Mutating methods (POST/PUT/PATCH/DELETE) explicitly disable early data, causing Envoy to buffer the request until handshake completion or return HTTP 425 (Too Early) per RFC 8470. Read-only idempotent routes permit early data and inject audit headers downstream.
```typescript
import { RouteConfiguration, FilterChain } from '@envoyproxy/envoy-definitions';

// PRODUCTION INVARIANT: RFC 8470 compliant anti-replay with explicit 425 status handling
export const createHardenedRoute = (): RouteConfiguration => ({
  name: 'api_routes',
  virtual_hosts: [{
    name: 'api_vhost',
    domains: ['api.enterprise.internal'],
    routes: [
      {
        match: {
          prefix: '/v1/mutations/',
          headers: [{ name: ':method', string_match: { safe_regex: { regex: '^(POST|PUT|PATCH|DELETE)$' } } }]
        },
        route: {
          cluster: 'upstream_microservice',
          // Invariant: Non-idempotent endpoints reject early data with HTTP 425
          early_data_policy: {
            name: 'envoy.route.early_data_policy.default',
            typed_config: {
              '@type': 'type.googleapis.com/envoy.extensions.early_data.v3.DefaultEarlyDataPolicy',
              // Rejects early data on mutating routes; Envoy automatically yields HTTP 425 (Too Early)
              allow_early_data: false
            }
          }
        }
      },
      {
        match: {
          prefix: '/v1/',
          headers: [{ name: ':method', string_match: { safe_regex: { regex: '^(GET|HEAD|OPTIONS)$' } } }]
        },
        route: {
          cluster: 'upstream_microservice',
          early_data_policy: {
            name: 'envoy.route.early_data_policy.default',
            typed_config: {
              '@type': 'type.googleapis.com/envoy.extensions.early_data.v3.DefaultEarlyDataPolicy',
              allow_early_data: true
            }
          },
          request_headers_to_add: [
            {
              header: { key: 'X-Forwarded-Early-Data', value: '%DOWNSTREAM_PEER_EARLY_DATA%' },
              append: false
            }
          ]
        }
      }
    ]
  }]
});
```
Recommended MCP Servers (mcp-serverlist.com)

Equip agent with system tools to verify code for this stack.

Envoy Config Validator MCP
Validates Envoy control plane xDS configurations against official protobuf schemas.
Recommended Agent Skills (askills.dev)

Ready-to-use executable skill functions tailored to this stack.

Envoy CLI Linter
Executes 'envoy --mode validate' inside CI/CD pipelines to verify route and transport layer security invariants.
Architectural Specification & Invariant Rationale

Architectural Invariant Design: Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail

Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces strict anti-replay mitigations for Envoy HTTP/3 QUIC 0-RTT early data before requests propagate to upstream services. Mandates RFC 8470 compliance, route-level early data policies restricting early frames to idempotent methods, and automated HTTP 425 (Too Early) rejections for unvalidated or mutable actions. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 Validation Without an explicit system instruction file, developers spend hours debugging silent failures.
Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure ModeAI Symptom (The Anti-Pattern)SeverityProduction Impact & Remedy
AI Hallucination & Deprecation DriftBlindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 ValidationCritical
Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production.
Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture InconsistencyAI assistants produce mixed paradigms across files, creating fragmented codebase conventions.Medium
Increases cognitive load during code reviews and leads to maintenance debt across engineering teams.
Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.
Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

1

Engineers MUST ALWAYS restrict HTTP/3 QUIC 0-RTT early data to safe, idempotent HTTP methods (GET, HEAD, OPTIONS) in Envoy route configurations.

Engineers MUST ALWAYS restrict HTTP/3 QUIC 0-RTT early data to safe, idempotent HTTP methods (GET, HEAD, OPTIONS) in Envoy route configurations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
2

Engineers MUST NOT permit non-idempotent verbs (POST, PUT, PATCH, DELETE) to execute in 0-RTT early data frames without handshake completion.

Engineers MUST NOT permit non-idempotent verbs (POST, PUT, PATCH, DELETE) to execute in 0-RTT early data frames without handshake completion.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
3

Services MUST emit an HTTP 425 (Too Early) status code when an unvalidated 0-RTT request arrives on an endpoint requiring anti-replay guarantees, instructing the client to retry over the confirmed 1-RTT connection.

Services MUST emit an HTTP 425 (Too Early) status code when an unvalidated 0-RTT request arrives on an endpoint requiring anti-replay guarantees, instructing the client to retry over the confirmed 1-RTT connection.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
4

Components NEVER accept early data if downstream TLS session ticket age skew exceeds the configured tolerance window.

Components NEVER accept early data if downstream TLS session ticket age skew exceeds the configured tolerance window.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
5

Envoy configurations SHOULD enable `envoy.route.early_data_policy.default` with explicit safe-method validation and set the upstream `Early-Data` header in compliance with RFC 8470.

Envoy configurations SHOULD enable `envoy.route.early_data_policy.default` with explicit safe-method validation and set the upstream `Early-Data` header in compliance with RFC 8470.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.
Enforcement:Integrated into the Agent Pack rule file. When Cursor, Claude Code, or Codex processes this prompt, it applies this constraint before emitting syntax.
Technical Questions & Answers

Frequently Asked Technical Questions

Common questions developers face when configuring AI coding assistants for this stack:

Q:Why is Envoy HTTP/3 QUIC 0-RTT Early Data Anti-Replay Guardrail critical for AI coding assistants?

Enforces strict anti-replay mitigations for Envoy HTTP/3 QUIC 0-RTT early data before requests propagate to upstream services. Mandates RFC 8470 compliance, route-level early data policies restricting early frames to idempotent methods, and automated HTTP 425 (Too Early) rejections for unvalidated or mutable actions. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.

Q:How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Blindly Forwarding 0-RTT QUIC Early Data on Mutating Endpoints Without Anti-Replay Buffering or RFC 8470 Validation) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q:Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q:Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Open Specification · CC BY 4.0·Free for Personal, Team & Commercial In-Repo Use

Citation & Open Source Attribution Guidelines

This specification is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). You are completely free to adapt and share this rule in your workspace. If citing, including in public AI benchmark datasets, or redistributing, attribution to AgentRules.org is required.

Related DEVOPS Rules

View all rules →
devops
86

Kubernetes Gateway API v1 HTTPRoute Canary and ReferenceGrant Invariants

Enforces strict conformance to Kubernetes Gateway API v1 specifications during migration from legacy Ingress controllers. Mandates explicit ReferenceGrant resources for cross-namespace routing, strict relative integer weighting for HTTPRoute canary releases, and explicit backendRef port declarations.

devops
118

ArgoCD ApplicationSet Matrix Generator Invariants & Cascade Deletion Guards

Enforces strict structural constraints on ArgoCD ApplicationSet Matrix generators combining cluster selectors and Git directories. Prevents catastrophic multi-cluster cascade pruning, accidental secret exposure through parameter interpolation, and runaway Application CR explosion via explicit sync policies, preservation finalizers, and parameter validation.

devops
40

Karpenter Resilient Topology, Interruption Queue, and Consolidation Budget Standard

Enforces deterministic disruption budgets, multi-instance-type diversification, and event-driven SQS interruption queue handling across Karpenter NodePools and EC2NodeClasses. Eliminates cascading eviction loops, instance starvation, and availability downtime during AWS Spot rebalances and underutilized node consolidation.

1 Rule in Stack

Envoy