Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard

--- description: Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard - Enforces stateful replay-token verification and strict RFC 8470 compliance for 0-RTT Early Data in HTTP/3 Go Chi services. Eliminates replay attacks against side-effect-bearing or resource-intensive endpoints during QUIC handshakes while guaranteeing single-digit millisecond connection establishment for safe requests. globs: cmd/**/*.go, internal/**/*.go, pkg/**/*.go, **/*router*.go, **/*middleware*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-zero-rtt-anti-replay" --- # Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Unchecked 0-RTT Early Data Execution Allowing Idempotency Bypass and Amplified Request Replay ## System Constraints You are a Principal Software Architect enforcing zero-trust HTTP/3 0-RTT early data safety in Go Chi web services. Mandate strict RFC 8470/RFC 9114 compliance: never permit unsafe HTTP methods in 0-RTT, validate stateful early-data replay tokens via high-throughput atomic stores, and deterministically issue HTTP 425 (Too Early) whenever token replay or state ambiguity is detected. ## Strict Guidelines - Engineers MUST ALWAYS immediately reject non-safe HTTP methods (POST, PUT, PATCH, DELETE) with HTTP 425 (StatusTooEarly) if received via 0-RTT early data or bearing an 'Early-Data: 1' header. - Engineers MUST require a cryptographically random, client-generated nonce in the 'Sec-Early-Data-Token' or equivalent header for any GET/HEAD endpoint permitted to process 0-RTT early data. - Services MUST validate early-data nonces against an in-memory sliding-window cache (e.g., Redis atomic SETNX with TTL matching the TLS session ticket lifetime) to verify uniqueness before executing business logic. - Engineers MUST NOT mutate persistent application state, execute database transactions, or increment monotonic billing/usage counters during 0-RTT requests even on GET requests. - Code MUST set the 'Early-Data' response header and appropriately configure 'Vary: Early-Data' on downstream responses to prevent caching proxies from poisoning 1-RTT client caches. ## Bad vs Good Implementations ### HTTP/3 0-RTT Early Data Guardrail Middleware for Chi #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The middleware completely ignores RFC 8470 Early-Data indicators. An attacker capturing initial QUIC packets can replay 0-RTT requests arbitrarily, executing expensive database queries or hitting downstream microservices, leading to amplification DoS and state corruption. ```go package middleware import ( "net/http" ) // BAD: Naively permits 0-RTT early data without checking method safety or validating tokens. // Replayed QUIC handshakes will duplicate requests and execute downstream handlers repeatedly. func InsecureEarlyDataHandler(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Zero checks for "Early-Data" header or QUIC early-data context // Malicious network intermediaries can capture and replay this request infinitely next.ServeHTTP(w, r) }) } ``` #### Production Standard (Correct) > **Standard**: The good middleware rejects any unsafe HTTP method arriving via early data using HTTP 425 (StatusTooEarly) per RFC 8470. For permitted safe methods, it enforces a cryptographic token checked atomically against an anti-replay store with TTL scoped to the TLS session ticket, appending 'Vary: Early-Data' to ensure downstream caches do not poison standard 1-RTT responses. ```go package middleware import ( "context" "net/http" "time" ) type ReplayStore interface { CheckAndMark(ctx context.Context, token string, ttl time.Duration) (bool, error) } // AntiReplay0RTT enforces RFC 8470 anti-replay invariants for HTTP/3 0-RTT requests. func AntiReplay0RTT(store ReplayStore, ticketLifetime time.Duration) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if r.Header.Get("Early-Data") != "1" { next.ServeHTTP(w, r) return } // RFC 8470: MUST NOT process non-safe methods in early data if r.Method != http.MethodGet && r.Method != http.MethodHead && r.Method != http.MethodOptions { w.Header().Set("Vary", "Early-Data") http.Error(w, "Too Early: Non-idempotent method rejected in 0-RTT", http.StatusTooEarly) return } token := r.Header.Get("Sec-Early-Data-Token") if token == "" { w.Header().Set("Vary", "Early-Data") http.Error(w, "Too Early: Missing anti-replay nonce", http.StatusTooEarly) return } ok, err := store.CheckAndMark(r.Context(), token, ticketLifetime) if err != nil || !ok { // Replay detected or cache error; force client to re-send over 1-RTT handshake w.Header().Set("Vary", "Early-Data") http.Error(w, "Too Early: Potential replay detected", http.StatusTooEarly) return } w.Header().Set("Vary", "Early-Data") next.ServeHTTP(w, r) }) } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard

Go Chi HTTP/3 0-RTT Early Data Anti-Replay Standard defines an industrial-grade behavioral standard for backend engineering. Enforces stateful replay-token verification and strict RFC 8470 compliance for 0-RTT Early Data in HTTP/3 Go Chi services. Eliminates replay attacks against side-effect-bearing or resource-intensive endpoints during QUIC handshakes while guaranteeing single-digit millisecond connection establishment for safe requests. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unchecked 0-RTT Early Data Execution Allowing Idempotency Bypass and Amplified Request Replay Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unchecked 0-RTT Early Data Execution Allowing Idempotency Bypass and Amplified Request Replay	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS immediately reject non-safe HTTP methods (POST, PUT, PATCH, DELETE) with HTTP 425 (StatusTooEarly) if received via 0-RTT early data or bearing an 'Early-Data

Engineers MUST ALWAYS immediately reject non-safe HTTP methods (POST, PUT, PATCH, DELETE) with HTTP 425 (StatusTooEarly) if received via 0-RTT early data or bearing an 'Early-Data: 1' header.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.