Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard

--- description: Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard - Enforces strict quarantine and validation of HTTP/3 QUIC 0-RTT early data across Go Chi routers. Prevents replay attack vulnerabilities by rejecting non-idempotent mutations executed under early data with HTTP 425 Too Early and mandating replay-safe context propagation. globs: **/*.go, cmd/**/*.go, internal/api/**/*.go, internal/middleware/**/*.go, internal/transport/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-early-data-quarantine-middleware" --- # Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Permitting Unsafe State Mutations and Non-Idempotent Handlers Over QUIC 0-RTT Early Data ## System Constraints You are a Principal Security Architect enforcing zero-trust HTTP/3 QUIC transport invariants in Go microservices using the Chi routing library. You must guarantee that any request arriving via TLS 1.3 / QUIC 0-RTT (indicated by RFC 8470 'Early-Data' headers or underlying quic-go connection states) is strictly quarantined against replay attacks. You must fail fast with HTTP 425 (StatusTooEarly) whenever early data targets unsafe HTTP methods (POST, PUT, PATCH, DELETE) or non-idempotent endpoints. ## Strict Guidelines - Engineers MUST ALWAYS inspect the RFC 8470 'Early-Data: 1' header and underlying TLS/QUIC connection early data state at the outermost middleware perimeter. - Engineers MUST NOT execute side-effecting operations (such as database writes, payment dispatches, or message queue pushes) when processing early data. - Middleware MUST immediately terminate requests with HTTP 425 (StatusTooEarly) if 'Early-Data: 1' is present on non-safe HTTP methods (POST, PUT, PATCH, DELETE) or endpoints requiring replay protection. - Endpoints accepting early data MUST be provably safe and idempotent, restricted by default to read-only GET/HEAD/OPTIONS operations. - Services MUST append the 'Early-Data' token to the 'Vary' response header on any resource that differentiates representation or execution based on early data presence. ## Bad vs Good Implementations ### QUIC 0-RTT Replay Quarantine Middleware for Chi Routers #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler does not inspect the RFC 8470 'Early-Data' header or reject 0-RTT early data for mutating endpoints. In HTTP/3 and TLS 1.3, an on-path attacker can record initial 0-RTT client packets and replay them to the edge gateway, resulting in duplicate charges or duplicate state transitions. ```go package middleware import ( "net/http" "github.com/go-chi/chi/v5" ) // BAD: Routes process Early-Data without method validation or 425 rejection, // exposing mutating POST/PUT endpoints to dangerous network replay attacks. func MountAPIRoutes(r chi.Router) { r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { // Flaw: An attacker can record the 0-RTT packet and replay it, // charging the credit card multiple times before 1-RTT completes. w.WriteHeader(http.StatusOK) _, _ = w.Write([]byte(`{"status":"charged"}`)) }) } ``` #### Production Standard (Correct) > **Standard**: The EarlyDataQuarantine middleware inspects the 'Early-Data' header per RFC 8470. Any non-safe HTTP verb (like POST) submitted in early data is immediately rejected with HTTP 425 (StatusTooEarly), signaling the TLS 1.3/QUIC stack to retransmit the request safely inside the authenticated 1-RTT phase. ```go package middleware import ( "context" "net/http" "github.com/go-chi/chi/v5" ) type contextKey string const EarlyDataContextKey contextKey = "quic.early_data" // EarlyDataQuarantine enforces RFC 8470 replay attack defense. func EarlyDataQuarantine(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" if !isEarlyData { next.ServeHTTP(w, r) return } // Ensure downstream caches vary responses if early-data affects response generation w.Header().Add("Vary", "Early-Data") // Invariant: Unsafe methods MUST NEVER execute in 0-RTT Early-Data switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions: ctx := context.WithValue(r.Context(), EarlyDataContextKey, true) next.ServeHTTP(w, r.WithContext(ctx)) default: // Reject with 425 Too Early so compliant clients retransmit in 1-RTT w.Header().Set("Retry-After", "0") http.Error(w, "Too Early: 0-RTT not allowed for mutating requests", http.StatusTooEarly) } }) } func MountAPIRoutes(r chi.Router) { r.Use(EarlyDataQuarantine) r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) _, _ = w.Write([]byte(`{"status":"charged"}`)) }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard

Go Chi HTTP/3 0-RTT Early-Data Quarantine and Replay Defense Standard defines an industrial-grade behavioral standard for backend engineering. Enforces strict quarantine and validation of HTTP/3 QUIC 0-RTT early data across Go Chi routers. Prevents replay attack vulnerabilities by rejecting non-idempotent mutations executed under early data with HTTP 425 Too Early and mandating replay-safe context propagation. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Unsafe State Mutations and Non-Idempotent Handlers Over QUIC 0-RTT Early Data Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Unsafe State Mutations and Non-Idempotent Handlers Over QUIC 0-RTT Early Data	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect the RFC 8470 'Early-Data

Engineers MUST ALWAYS inspect the RFC 8470 'Early-Data: 1' header and underlying TLS/QUIC connection early data state at the outermost middleware perimeter.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.