Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier

--- description: Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier - Enforces an application-layer barrier against TLS 1.3 and QUIC 0-RTT early-data replay amplification attacks within Go Chi routers. State-mutating requests (POST, PUT, PATCH, DELETE) received as early data must be rejected immediately with HTTP 425 (Too Early) before hitting business logic or database layers. globs: **/router.go, **/routes.go, **/middleware/*.go, **/server.go, pkg/http/**/*.go, cmd/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-zero-rtt-anti-replay-barrier" --- # Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing state-mutating operations on unvalidated 0-RTT early data requests ## System Constraints You are a Principal Software Architect enforcing zero-trust transport-layer invariants in Go Chi services running over HTTP/3 and QUIC. 0-RTT (early data) in TLS 1.3/QUIC does not provide replay protection. You must strictly mandate that all state-mutating HTTP methods (POST, PUT, PATCH, DELETE) reject 0-RTT early data at the middleware layer using HTTP 425 (StatusTooEarly) to prevent financial double-spends, state corruption, and replay amplification attacks. ## Strict Guidelines - Engineers MUST ALWAYS register an Anti-Replay Early-Data middleware at the root router before any state-mutating routes or stateful business middleware. - Engineers MUST inspect both the standardized RFC 8470 `Early-Data` header and the underlying TLS/QUIC connection state to detect 0-RTT payloads. - Middleware MUST immediately terminate request processing and return HTTP 425 (`http.StatusTooEarly`) when a non-safe HTTP method (POST, PUT, PATCH, DELETE) is detected in 0-RTT early data. - Safe methods (GET, HEAD, OPTIONS) MAY proceed under 0-RTT only if handlers are strictly idempotent and free of covert state mutations or resource billing side-effects. - Services MUST NOT execute authentication tokens, database transactions, or external payment/webhook dispatchers on unvalidated early data. - The middleware MUST inject standard caching and retry headers (`Retry-After: 0` or QUIC handshake completion hints) to instruct compliant clients to retry on 1-RTT completion. ## Bad vs Good Implementations ### Go Chi HTTP/3 0-RTT Anti-Replay Barrier Implementation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler blindly accepts POST requests that may have been sent as TLS 1.3/QUIC 0-RTT early data. Adversaries can capture the raw 0-RTT UDP packets and replay them to cause duplicate charges, phantom resource allocations, or denial of service before handshake finalization. ```go package server import ( "net/http" "github.com/go-chi/chi/v5" ) func MountRoutes(r *chi.Mux) { // VULNERABLE: Direct registration of state-mutating endpoints over HTTP/3 // 0-RTT Early-Data replay attacks can duplicate orders or debit balances r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { // State mutation executed without verifying handshake completeness processCreditCardCharge(r.Context(), r.Body) w.WriteHeader(http.StatusCreated) }) } ``` #### Production Standard (Correct) > **Standard**: The AntiReplayBarrier middleware intercepts incoming requests at the outer router perimeter. If an incoming request contains 0-RTT early data (`Early-Data: 1` or an incomplete TLS handshake) and targets an unsafe method, it returns HTTP 425 (StatusTooEarly) with `Retry-After: 0`, forcing compliant HTTP/3 clients to replay the mutation only after the full 1-RTT cryptographic handshake is established. ```go package server import ( "net/http" "strings" "github.com/go-chi/chi/v5" ) // AntiReplayBarrier rejects early data on non-idempotent HTTP methods per RFC 8470. func AntiReplayBarrier(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" if !isEarlyData && r.TLS != nil { // Check TLS 1.3 DidResume / early data if exposed by HTTP/3 transport isEarlyData = !r.TLS.HandshakeComplete } if isEarlyData { method := strings.ToUpper(r.Method) switch method { case http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete: // Reject early-data mutation; instruct client to retry after 1-RTT w.Header().Set("Retry-After", "0") http.Error(w, "Too Early: state mutations prohibited in 0-RTT", http.StatusTooEarly) return } } next.ServeHTTP(w, r) }) } func MountRoutes(r *chi.Mux) { // Apply barrier globally or to mutation route groups r.Use(AntiReplayBarrier) r.Post("/api/v1/orders/charge", func(w http.ResponseWriter, r *http.Request) { processCreditCardCharge(r.Context(), r.Body) w.WriteHeader(http.StatusCreated) }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier

Go Chi HTTP/3 0-RTT Anti-Replay Mutation Barrier defines an industrial-grade behavioral standard for backend engineering. Enforces an application-layer barrier against TLS 1.3 and QUIC 0-RTT early-data replay amplification attacks within Go Chi routers. State-mutating requests (POST, PUT, PATCH, DELETE) received as early data must be rejected immediately with HTTP 425 (Too Early) before hitting business logic or database layers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing state-mutating operations on unvalidated 0-RTT early data requests Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing state-mutating operations on unvalidated 0-RTT early data requests	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS register an Anti-Replay Early-Data middleware at the root router before any state-mutating routes or stateful business middleware.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.