Go Chi v5 HTTP/3 0-RTT Anti-Replay Guardrail

--- description: "Go Chi v5 HTTP/3 0-RTT Anti-Replay Guardrail - Enforces strict replay detection and mitigation on HTTP/3 (QUIC) 0-RTT Early Data packets within Go Chi v5 routers. State-changing HTTP methods transmitted via early data are vulnerable to network replay attacks, requiring immediate rejection with HTTP 425 Too Early or atomic single-use nonce validation before handler execution." globs: "**/*.go, cmd/**/*.go, internal/**/*.go, pkg/**/*.go" alwaysApply: true license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-0rtt-anti-replay-guardrail-go-chi-v5-http-3-225" --- # Go Chi v5 HTTP/3 0-RTT Anti-Replay Guardrail > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Unconditional Execution of Mutating HTTP Methods via HTTP/3 0-RTT Early Data ## System Constraints You are a Principal Backend Security Architect enforcing strict HTTP/3 0-RTT anti-replay boundaries in Go Chi v5 services. QUIC 0-RTT allows clients to send application data in the initial handshake packet before the TLS 1.3 handshake completes. Because attackers can capture and replay 0-RTT packets across the network, non-idempotent or state-changing requests (POST, PUT, PATCH, DELETE) processed during 0-RTT can trigger duplicate billing, resource creation, or credential invalidation. You must ensure all Chi routers processing HTTP/3 traffic deploy middleware that checks for early data status, rejects non-idempotent early data with RFC 8470 '425 Too Early', or verifies single-use replay protection tokens using an atomic distributed store. ## Strict Guidelines - Engineers MUST ALWAYS enforce RFC 8470 compliance on HTTP/3 services by inspecting early data indicators on all non-idempotent HTTP methods (POST, PUT, PATCH, DELETE). - Services MUST return HTTP status code 425 (Too Early) when state-changing requests arrive over 0-RTT early data without an explicit, validated anti-replay token. - Engineers MUST NOT allow Chi route handlers executing monetary, inventory, or security-sensitive transactions to execute under unvalidated 0-RTT contexts. - Middleware MUST attach the connection's early-data state into the request's context.Context so downstream telemetry and security audits can detect replay exposure. - Code SHOULD enforce early data restrictions globally at the Chi root router before entering child routers or executing business middleware. - Components NEVER treat 0-RTT QUIC packets as secure against network replay simply because the TLS connection was eventually established. ## Bad vs Good Implementations ### Anti-Pattern: Executing Mutating Routes on HTTP/3 Without 0-RTT Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The Chi router exposes a mutating endpoint (/api/v1/orders/charge) over HTTP/3 without detecting or preventing 0-RTT early data. In QUIC, TLS 1.3 0-RTT early data packets can be captured by an adversary and replayed to duplicate state-changing operations. ```go package main import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) func SetupRouter() *chi.Mux { r := chi.NewRouter() // CRITICAL FLAW: Exposing state-changing mutation directly to HTTP/3 without checking 0-RTT. // An on-path or passive attacker can intercept the client's initial QUIC 0-RTT packet // and replay it against the server, executing duplicate charges. r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { // Execute critical payment logic w.WriteHeader(http.StatusOK) _, _ = w.Write([]byte(`{"status":"charged"}`)) }) return r } func main() { r := SetupRouter() server := http3.Server{ Addr: ":443", Handler: r, } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ``` #### Production Standard (Correct) > **Standard**: The AntiReplay0RTT middleware checks the Early-Data header pursuant to RFC 8470. Any non-safe HTTP method transmitted via early data is rejected with 425 Too Early before invoking application logic, forcing the HTTP/3 client to replay the request over a fully negotiated 1-RTT connection. ```go package main import ( "context" "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) type contextKey string const earlyDataContextKey contextKey = "is_early_data" // AntiReplay0RTT protects state-changing routes against HTTP/3 0-RTT replay attacks (RFC 8470). func AntiReplay0RTT(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" // Safe methods (GET, HEAD, OPTIONS) can proceed over early data if idempotent. switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace: ctx := context.WithValue(r.Context(), earlyDataContextKey, isEarlyData) next.ServeHTTP(w, r.WithContext(ctx)) return default: // State-changing requests (POST, PUT, DELETE, PATCH) MUST NOT run in 0-RTT without mitigation. if isEarlyData { // Instruct client to retry over 1-RTT once handshake is complete (RFC 8470 §5.2) w.Header().Set("Early-Data", "1") w.Header().Set("Retry-After", "0") http.Error(w, "Too Early: 0-RTT replay protection triggered", http.StatusTooEarly) return } next.ServeHTTP(w, r) } }) } func SetupRouter() *chi.Mux { r := chi.NewRouter() r.Use(AntiReplay0RTT) r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/json") w.WriteHeader(http.StatusOK) _, _ = w.Write([]byte(`{"status":"charged"}`)) }) return r } func main() { r := SetupRouter() server := http3.Server{ Addr: ":443", Handler: r, } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi v5 HTTP/3 0-RTT Anti-Replay Guardrail

Go Chi v5 HTTP/3 0-RTT Anti-Replay Guardrail defines an industrial-grade behavioral standard for backend engineering. Enforces strict replay detection and mitigation on HTTP/3 (QUIC) 0-RTT Early Data packets within Go Chi v5 routers. State-changing HTTP methods transmitted via early data are vulnerable to network replay attacks, requiring immediate rejection with HTTP 425 Too Early or atomic single-use nonce validation before handler execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unconditional Execution of Mutating HTTP Methods via HTTP/3 0-RTT Early Data Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unconditional Execution of Mutating HTTP Methods via HTTP/3 0-RTT Early Data	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce RFC 8470 compliance on HTTP/3 services by inspecting early data indicators on all non-idempotent HTTP methods (POST, PUT, PATCH, DELETE).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.