Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests

--- description: Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests - Enforces strict HTTP/3 QUIC 0-RTT (Early Data) validation invariants within Go Chi routing pipelines to prevent replay attacks on state-mutating operations. Mutating HTTP verbs (POST, PUT, PATCH, DELETE) and unsafe GET endpoints must reject Early Data with HTTP 425 Too Early or require single-use cryptographic token validation before execution. Safe read paths utilizing 0-RTT must be verified strictly idempotent and protected against side-effect leakages. globs: cmd/**/*.go, internal/api/**/*.go, internal/transport/**/*.go, pkg/middleware/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-http3-zero-rtt-anti-replay-gate" --- # Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing Unvalidated State-Mutating Operations Inside Replayable QUIC 0-RTT Early Data Payloads ## System Constraints You are a Principal Backend and Security Engineer enforcing strict HTTP/3 0-RTT Anti-Replay invariants in Go services utilizing Chi and quic-go/http3. Mandate that all state-mutating requests (POST, PUT, PATCH, DELETE) arriving in 0-RTT Early Data are rejected immediately with HTTP 425 (Too Early) or gated behind an atomic, distributed replay cache. Ensure that developers never blindly accept Early Data on non-idempotent endpoints, and enforce proper HTTP/3 TLS 1.3 handshake verification at the Chi middleware layer. ## Strict Guidelines - Engineers MUST ALWAYS inspect HTTP/3 Early Data status on incoming requests using `http.Request.TLS.EarlyData` or the underlying `quic-go/http3` connection context. - Engineers MUST IMMEDIATELY reject mutating HTTP verbs (POST, PUT, PATCH, DELETE) received as Early Data by returning `http.StatusTooEarly` (HTTP 425) unless protected by an atomic, distributed single-use replay cache. - Engineers MUST configure Chi middleware to append `Early-Data: 1` downstream headers when Early Data is permitted on safe, read-only GET/HEAD endpoints. - Services MUST NOT execute database mutations, payment charges, or non-idempotent business logic inside unverified 0-RTT handshakes. - Code MUST handle the standard retry behavior for clients receiving HTTP 425 by ensuring downstream handlers avoid emitting partial side-effects prior to status return. ## Bad vs Good Implementations ### Chi Anti-Replay 0-RTT Middleware and Route Gating #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The endpoint processes state-mutating POST requests without verifying whether the request arrived via HTTP/3 0-RTT Early Data. Replaying the initial QUIC packet duplicates the financial transfer because TLS 1.3 Early Data lacks anti-replay guarantees across network-level re-transmissions. ```go package transport import ( "net/http" "github.com/go-chi/chi/v5" ) func RegisterRoutes(r chi.Router) { // VULNERABLE: Direct registration without 0-RTT Early Data gate. // Over HTTP/3, an attacker can capture the 0-RTT QUIC initial packets // and replay balance transfer requests multiple times before handshake finalizes. r.Post("/api/v1/transfers", func(w http.ResponseWriter, r *http.Request) { // Execute state mutation directly w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"transferred"}`)) }) } ``` #### Production Standard (Correct) > **Standard**: The `RejectEarlyData` middleware checks `r.TLS.EarlyData` and immediately terminates the request with HTTP 425 (Too Early) and a `Retry-After` header. This forces the HTTP/3 client to retransmit the mutating payload strictly after the TLS 1.3 1-RTT handshake completes, eliminating replay attack vectors. ```go package transport import ( "net/http" "github.com/go-chi/chi/v5" ) // RejectEarlyData returns HTTP 425 (Too Early) if the request was sent in 0-RTT Early Data. func RejectEarlyData(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Check if connection was negotiated over TLS 1.3 with Early Data if r.TLS != nil && r.TLS.EarlyData { w.Header().Set("Retry-After", "1") w.WriteHeader(http.StatusTooEarly) w.Write([]byte(`{"error":"0-RTT early data rejected for mutating endpoints"}`)) return } next.ServeHTTP(w, r) }) } func RegisterRoutes(r chi.Router) { r.Group(func(mutating chi.Router) { mutating.Use(RejectEarlyData) mutating.Post("/api/v1/transfers", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"transferred"}`)) }) }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests

Go Chi HTTP/3 0-RTT Anti-Replay Verification Gate for Mutating Requests defines an industrial-grade behavioral standard for backend engineering. Enforces strict HTTP/3 QUIC 0-RTT (Early Data) validation invariants within Go Chi routing pipelines to prevent replay attacks on state-mutating operations. Mutating HTTP verbs (POST, PUT, PATCH, DELETE) and unsafe GET endpoints must reject Early Data with HTTP 425 Too Early or require single-use cryptographic token validation before execution. Safe read paths utilizing 0-RTT must be verified strictly idempotent and protected against side-effect leakages. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing Unvalidated State-Mutating Operations Inside Replayable QUIC 0-RTT Early Data Payloads Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing Unvalidated State-Mutating Operations Inside Replayable QUIC 0-RTT Early Data Payloads	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect HTTP/3 Early Data status on incoming requests using `http.Request.TLS.EarlyData` or the underlying `quic-go/http3` connection context.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.