Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unvalidated 0-RTT Early Data Processing on Non-Idempotent Endpoints Enabling Multi-Node Replay Attacks) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing

--- description: Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing - Enforces distributed anti-replay validation for HTTP/3 0-RTT (Early Data) across multi-node Go Chi edge deployments. Protects against TLS 1.3 replay attacks by gating early data behind synchronized monotonic timestamp windows, strict HTTP method idempotency enforcement, and atomic single-use ticket reservation backed by a distributed key-value store. globs: **/server/**/*.go, **/transport/**/*.go, **/middleware/**/*.go, **/cmd/**/*.go, **/pkg/http3/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-zero-rtt-anti-replay-fencing" --- # Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Unvalidated 0-RTT Early Data Processing on Non-Idempotent Endpoints Enabling Multi-Node Replay Attacks ## System Constraints You are a Principal Security and Systems Architect enforcing zero-trust TLS 1.3/QUIC 0-RTT semantics in Go Chi HTTP/3 services. You must reject any configuration or middleware pattern that exposes non-idempotent handlers to 0-RTT replay, processes early data without monotonic timestamp fencing, or permits cross-node ticket reuse without atomic single-use ticket tracking. ## Strict Guidelines - Services MUST ALWAYS inspect early data flags on incoming QUIC/HTTP/3 requests and immediately return HTTP 425 'Too Early' if the route method is non-idempotent (e.g., POST, PATCH, non-idempotent PUT/DELETE). - Engineers MUST ALWAYS enforce strict monotonic wall-clock validity windows (drift delta <= 2000ms) on session resumption timestamps embedded in TLS ticket extensions before processing early requests. - Engineers MUST NOT configure quic-go or Chi HTTP/3 listeners to automatically process 0-RTT data without an atomic distributed deduplication ledger (e.g., Redis SETNX with automatic TTL expiration matched to ticket lifetime). - Code MUST gate state-changing or authenticated session operations behind confirmed 1-RTT completion handshake events, refusing execution under EarlyData context. - Middleware MUST record telemetry and immediately abort connection streams when detecting duplicate ticket identifiers within the active ticket validity window. ## Bad vs Good Implementations ### Naive HTTP/3 0-RTT Acceptance vs. Monotonic Anti-Replay Fencing Middleware #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler processes HTTP POST requests sent via 0-RTT without checking if the early handshake completed, and without checking session ticket freshness or deduplication across cluster nodes. An eavesdropper can replay the raw QUIC Initial packet, invoking the /charge endpoint multiple times. ```go package transport import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) func SetupRouter() http.Handler { r := chi.NewRouter() // ANTI-PATTERN: Blindly routing 0-RTT early data to mutating endpoints. // An adversary capturing the initial QUIC flight can replay this request // against any replica in the edge cluster, causing duplicate balance deductions. r.Post("/api/v1/charge", func(w http.ResponseWriter, r *http.Request) { // r.TLS may have HandshakeComplete == false if EarlyData was accepted w.WriteHeader(http.StatusOK) w.Write([]byte(`{"status":"charged"}`)) }) return r } func RunServer(handler http.Handler) error { server := &http3.Server{ Addr: ":443", Handler: handler, // QUIC EarlyData allowed with zero validation or fencing } return server.ListenAndServeTLS("cert.pem", "key.pem") } ``` #### Production Standard (Correct) > **Standard**: The production middleware validates safe HTTP methods for 0-RTT early data according to RFC 8470, mandates monotonic time drift fencing within a tight window (2 seconds), and enforces atomic single-use ticket reservation using distributed Redis SetNX to eliminate cross-node replay vulnerabilities. ```go package transport import ( "context" "crypto/subtle" "errors" "net/http" "strconv" "time" "github.com/go-chi/chi/v5" "github.com/redis/go-redis/v9" ) const ( MaxDriftWindow = 2 * time.Second TicketTTL = 10 * time.Minute ) type AntiReplayFencer struct { rdb *redis.Client } func NewAntiReplayFencer(rdb *redis.Client) *AntiReplayFencer { return &AntiReplayFencer{rdb: rdb} } // AntiReplayMiddleware enforces RFC 8470 / RFC 9114 0-RTT safety invariants. func (f *AntiReplayFencer) AntiReplayMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" || (r.TLS != nil && !r.TLS.HandshakeComplete) if !isEarlyData { next.ServeHTTP(w, r) return } // Invariant 1: RFC 8470 Section 5.2 - Early data must only use safe idempotent methods if r.Method != http.MethodGet && r.Method != http.MethodHead && r.Method != http.MethodOptions { w.Header().Set("Retry-After", "0") http.Error(w, "Too Early: 0-RTT prohibited on non-idempotent method", http.StatusTooEarly) return } // Invariant 2: Distributed Single-Use Ticket Fencing with Monotonic Clock Validation ticketID := r.Header.Get("Sec-Session-Ticket-ID") clientTimeRaw := r.Header.Get("Sec-Session-Timestamp") if ticketID == "" || clientTimeRaw == "" { http.Error(w, "Too Early: missing session fence credentials", http.StatusTooEarly) return } clientUnix, err := strconv.ParseInt(clientTimeRaw, 10, 64) if err != nil { http.Error(w, "Too Early: malformed session timestamp", http.StatusTooEarly) return } clientTime := time.Unix(clientUnix, 0) if time.Since(clientTime).Abs() > MaxDriftWindow { http.Error(w, "Too Early: timestamp outside drift window", http.StatusTooEarly) return } // Atomically claim the ticket across all distributed edge instances ok, err := f.rdb.SetNX(r.Context(), "quic:ticket:"+ticketID, "consumed", TicketTTL).Result() if err != nil || !ok { http.Error(w, "Too Early: replay ticket already consumed", http.StatusTooEarly) return } next.ServeHTTP(w, r) }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing

Go Chi HTTP/3 0-RTT Anti-Replay Session Ticket Fencing defines an industrial-grade behavioral standard for backend engineering. Enforces distributed anti-replay validation for HTTP/3 0-RTT (Early Data) across multi-node Go Chi edge deployments. Protects against TLS 1.3 replay attacks by gating early data behind synchronized monotonic timestamp windows, strict HTTP method idempotency enforcement, and atomic single-use ticket reservation backed by a distributed key-value store. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated 0-RTT Early Data Processing on Non-Idempotent Endpoints Enabling Multi-Node Replay Attacks Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated 0-RTT Early Data Processing on Non-Idempotent Endpoints Enabling Multi-Node Replay Attacks	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Services MUST ALWAYS inspect early data flags on incoming QUIC/HTTP/3 requests and immediately return HTTP 425 'Too Early' if the route method is non-idempotent (e.g., POST, PATCH, non-idempotent PUT/DELETE).

Services MUST ALWAYS inspect early data flags on incoming QUIC/HTTP/3 requests and immediately return HTTP 425 'Too Early' if the route method is non-idempotent (e.g., POST, PATCH, non-idempotent PUT/DELETE).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.