Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard

--- description: Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard - Enforces strict rejection of non-idempotent HTTP methods in QUIC/HTTP/3 0-RTT early data and mandates distributed replay cache verification for permissible early requests. Protects state-mutating handlers from double-execution vulnerabilities caused by network-level packet replication or passive eavesdropper replays during TLS 1.3/QUIC connection resumption. globs: **/*.go, cmd/**/*.go, internal/**/*.go, pkg/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-early-data-anti-replay-go-chi-http-3-0--597" --- # Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing state-mutating operations or unverified idempotent calls over HTTP/3 0-RTT early data ## System Constraints You are a Principal Backend Security Architect enforcing the Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard. TLS 1.3 and QUIC 0-RTT early data do not provide forward secrecy and are intrinsically vulnerable to packet replay attacks by network observers. You must mandate that all mutating HTTP methods (POST, PUT, PATCH, DELETE) received during 0-RTT handshakes are rejected with HTTP 425 (Too Early), and that any allowed 0-RTT GET/HEAD requests undergo distributed deduplication via an anti-replay token cache. ## Strict Guidelines - Engineers MUST ALWAYS inspect the HTTP request header 'Early-Data' or evaluate the underlying quic-go TLS connection state to detect 0-RTT execution before reaching business logic. - Engineers MUST IMMEDIATELY abort and respond with HTTP 425 (StatusTooEarly) if a non-idempotent or state-mutating HTTP method (POST, PUT, PATCH, DELETE) is transmitted in early data. - Engineers MUST NOT disable TLS 1.3 replay mitigation or accept arbitrary early data without checking an ephemeral distributed cache (e.g., Redis cluster) for duplicate client tickets or request signatures. - Services MUST implement Chi-compatible middleware that parses 'Early-Data: 1' and validates that client-provided idempotency keys have not been processed within the QUIC ticket validity window. - Components NEVER execute financial transactions, database writes, external mutations, or side-effecting operations inside early-data execution paths. ## Bad vs Good Implementations ### Chi HTTP/3 0-RTT Early-Data Replay Guard Middleware #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler accepts mutating POST requests directly over HTTP/3 without checking whether the request arrived via 0-RTT early data. In QUIC/TLS 1.3, an eavesdropper can replay the initial 0-RTT ClientHello and encrypted request data to double-execute payment processing without cracking TLS encryption. ```go package server import ( "net/http" "github.com/go-chi/chi/v5" ) func RegisterRoutes(r chi.Router) { // VULNERABLE: Direct registration of state-mutating endpoint on HTTP/3 server // An attacker capturing QUIC 0-RTT packets can replay this request indefinitely, // causing duplicate charges before the TLS handshake completes. r.Post("/api/v1/payments/charge", func(w http.ResponseWriter, r *http.Request) { ProcessPayment(r.Context(), r.Body) w.WriteHeader(http.StatusOK) }) } ``` #### Production Standard (Correct) > **Standard**: Implements RFC 8470 compliance. The middleware checks the Early-Data header, immediately returns HTTP 425 Too Early with a Retry-After header for unsafe HTTP methods (such as POST), and performs atomic distributed deduplication via Redis SetNX for safe requests to protect against 0-RTT replay loops. ```go package server import ( "context" "crypto/sha256" "encoding/hex" "fmt" "net/http" "time" "github.com/go-chi/chi/v5" "github.com/redis/go-redis/v9" ) type AntiReplayStore interface { SetNX(ctx context.Context, key string, val string, expiration time.Duration) *redis.BoolCmd } // HTTP3EarlyDataGuard rejects non-idempotent methods in 0-RTT and deduplicates GETs func HTTP3EarlyDataGuard(store AntiReplayStore, window time.Duration) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" if !isEarlyData { next.ServeHTTP(w, r) return } // RFC 8470: Reject any non-safe/mutating HTTP methods with 425 Too Early switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions: // Safe methods continue to deduplication check default: w.Header().Set("Retry-After", "1") http.Error(w, "Too Early: Mutating operations prohibited in 0-RTT", http.StatusTooEarly) return } // Derive replay fingerprint for 0-RTT safe requests rawFingerprint := fmt.Sprintf("%s:%s:%s", r.RemoteAddr, r.RequestURI, r.Header.Get("Authorization")) h := sha256.Sum256([]byte(rawFingerprint)) fingerprint := hex.EncodeToString(h[:]) key := fmt.Sprintf("quic:replay:%s", fingerprint) ok, err := store.SetNX(r.Context(), key, "1", window).Result() if err != nil || !ok { w.Header().Set("Retry-After", "1") http.Error(w, "Too Early: Suspected Replay", http.StatusTooEarly) return } next.ServeHTTP(w, r) }) } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard

Go Chi HTTP/3 0-RTT Early-Data Anti-Replay Idempotency Standard defines an industrial-grade behavioral standard for backend engineering. Enforces strict rejection of non-idempotent HTTP methods in QUIC/HTTP/3 0-RTT early data and mandates distributed replay cache verification for permissible early requests. Protects state-mutating handlers from double-execution vulnerabilities caused by network-level packet replication or passive eavesdropper replays during TLS 1.3/QUIC connection resumption. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing state-mutating operations or unverified idempotent calls over HTTP/3 0-RTT early data Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing state-mutating operations or unverified idempotent calls over HTTP/3 0-RTT early data	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect the HTTP request header 'Early-Data' or evaluate the underlying quic-go TLS connection state to detect 0-RTT execution before reaching business logic.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.