Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier

--- description: Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier - Enforces a cryptographic sliding-window verification barrier and strict idempotency checks on HTTP/3 (QUIC) Early Data requests in Go Chi services. Eliminates replay attack vectors before unvalidated 0-RTT payloads reach application handlers, preventing state-mutating double-execution. globs: cmd/**/*.go, internal/**/*.go, pkg/**/*.go, server/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-quic-0rtt-anti-replay-barrier" --- # Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Exposing mutating or unvalidated handlers to raw HTTP/3 0-RTT Early Data without cryptographic replay detection ## System Constraints You are a Principal Systems and Security Architect enforcing zero-trust replay defenses for HTTP/3 over QUIC in Go Chi applications. TLS 1.3 / QUIC 0-RTT Early Data lacks forward secrecy and is fundamentally vulnerable to network-level replay attacks by passive on-path adversaries. You must enforce that early data is strictly rejected on state-mutating methods (POST, PUT, PATCH, DELETE) and bounded by a cryptographic sliding-window token filter (e.g., Bloom filter backed by monotonic time windows and Redis/memory-backed cache) on safe methods before any application router evaluates the request context. ## Strict Guidelines - Engineers MUST ALWAYS inspect `http.Request.TLS` for early data flags or header-signaled 0-RTT markers (`Early-Data: 1`) using a dedicated upstream Chi middleware prior to routing. - Engineers MUST REJECT all non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) with HTTP 425 'Too Early' whenever early data is detected, forcing the client to retransmit after the 1-RTT handshake completes. - Engineers MUST enforce a distributed cryptographic sliding-window barrier (nonce/jti + timestamp + HMAC/signature verification) for any idempotent early data requests to prevent duplicate side effects. - Services MUST emit the `Early-Data` response header validation and configure QUIC listeners (`quic-go`) with explicit `Allow0RTT` policy functions that reject unauthenticated session resumption. - Components NEVER execute database writes, payment triggers, or audit log mutations inside an early-data request context unless the request has successfully transitioned through the idempotency filter and verified unique. - Code MUST return status code 425 (Too Early) immediately upon replay token collision or window expiration without invoking downstream Chi middleware chains. ## Bad vs Good Implementations ### HTTP/3 0-RTT Middleware Guardrail in Go Chi #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler accepts early-data payloads across HTTP/3 QUIC 0-RTT without checking for the 'Early-Data' header or inspecting QUIC connection state. Mutating POST operations can be replayed infinitely by network eavesdroppers. ```go package server import ( "net/http" "github.com/go-chi/chi/v5" ) func RegisterRoutes(r *chi.Mux) { // VULNERABLE: 0-RTT Early Data reaches state-changing endpoint directly. // An on-path adversary can capture the QUIC Initial/0-RTT packet and replay // it multiple times, leading to duplicate payment transactions. r.Post("/api/v1/payments", func(w http.ResponseWriter, r *http.Request) { ProcessPayment(r.Context(), r.Body) w.WriteHeader(http.StatusOK) }) } ``` #### Production Standard (Correct) > **Standard**: Safeguards the Chi pipeline with an early-data barrier. State-modifying requests are instantly rejected with HTTP 425 (Too Early) per RFC 8470, while read/idempotent early requests must clear an atomic sliding-window nonce verification. ```go package server import ( "crypto/subtle" "net/http" "strconv" "time" "github.com/go-chi/chi/v5" ) type ReplayStore interface { TestAndSet(key string, window time.Duration) (bool, error) } func EarlyDataIdempotencyBarrier(store ReplayStore, window time.Duration) func(http.Handler) http.Handler { return func(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarly := r.Header.Get("Early-Data") == "1" || (r.TLS != nil && !r.TLS.HandshakeComplete) if !isEarly { next.ServeHTTP(w, r) return } // Invariant 1: Reject non-idempotent methods on early data immediately switch r.Method { case http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete: w.Header().Set("Retry-After", "1") http.Error(w, "Too Early", http.StatusTooEarly) return } // Invariant 2: Cryptographic sliding-window token enforcement token := r.Header.Get("X-Early-Data-Nonce") if token == "" { http.Error(w, "Nonce Required in Early Data", http.StatusTooEarly) return } seen, err := store.TestAndSet(token, window) if err != nil || seen { w.Header().Set("Retry-After", "1") http.Error(w, "Replay Detected or Barrier Error", http.StatusTooEarly) return } w.Header().Set("Early-Data", "ok") next.ServeHTTP(w, r) }) } } func RegisterRoutes(r *chi.Mux, store ReplayStore) { r.Use(EarlyDataIdempotencyBarrier(store, 10*time.Second)) r.Post("/api/v1/payments", func(w http.ResponseWriter, r *http.Request) { ProcessPayment(r.Context(), r.Body) w.WriteHeader(http.StatusOK) }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier

Go Chi HTTP/3 0-RTT Anti-Replay Idempotency Barrier defines an industrial-grade behavioral standard for backend engineering. Enforces a cryptographic sliding-window verification barrier and strict idempotency checks on HTTP/3 (QUIC) Early Data requests in Go Chi services. Eliminates replay attack vectors before unvalidated 0-RTT payloads reach application handlers, preventing state-mutating double-execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exposing mutating or unvalidated handlers to raw HTTP/3 0-RTT Early Data without cryptographic replay detection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exposing mutating or unvalidated handlers to raw HTTP/3 0-RTT Early Data without cryptographic replay detection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect `http.Request.TLS` for early data flags or header-signaled 0-RTT markers (`Early-Data

Engineers MUST ALWAYS inspect `http.Request.TLS` for early data flags or header-signaled 0-RTT markers (`Early-Data: 1`) using a dedicated upstream Chi middleware prior to routing.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.