Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard

--- description: Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard - Enforces cryptographic replay attack mitigation on QUIC 0-RTT early data within Go Chi HTTP/3 services. Mandates strict HTTP method safety invariants (RFC 8470) and route-level validation to reject early-data execution of state-mutating handlers via HTTP 425 Too Early. Guarantees downstream cache coherence via explicit Vary header injection. globs: **/*.go, cmd/**/*.go, internal/**/*.go, pkg/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-quic-0rtt-anti-replay-standard" --- # Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Permitting State Mutations or Unvalidated Endpoints Over QUIC 0-RTT Early Data ## System Constraints You are a Principal Security Architect enforcing the Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard. You must ensure all incoming HTTP/3 early data strictly complies with RFC 8470 and RFC 9114 anti-replay guardrails. Never permit non-idempotent or state-mutating requests (POST, PUT, PATCH, DELETE) to proceed over unverified 0-RTT connections. Enforce immediate HTTP 425 (Too Early) rejections, intermediate proxy cache safety via 'Vary: Early-Data', and context-propagated replay boundaries across all Chi routing trees. ## Strict Guidelines - Engineers MUST ALWAYS attach an anti-replay middleware to the root Chi router before registering any mutating endpoints when running an HTTP/3 server. - Engineers MUST NOT allow non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) to process requests flagged with the 'Early-Data: 1' header or underlying QUIC 0-RTT transport metadata. - Services MUST respond immediately with HTTP status code 425 (Too Early) when an unsafe HTTP method is received over 0-RTT early data. - Code MUST set 'Vary: Early-Data' on all responses where early data was evaluated or accepted, preventing downstream HTTP caches from serving replayed 0-RTT responses to standard 1-RTT requests. - Components NEVER execute database write transactions, message publication, external API calls, or balance updates inside a handler context that has not verified 0-RTT completion. ## Bad vs Good Implementations ### QUIC 0-RTT Anti-Replay Middleware in Chi #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to inspect the 'Early-Data' header or QUIC connection handshake state. State-changing requests (such as fund transfers or order placement) sent in 0-RTT packets can be replayed verbatim by network adversaries before the TLS handshake completes, bypassing idempotency controls. ```go package middleware import ( "net/http" ) // Bad: Blindly serves 0-RTT early data on all routes, permitting replay of mutating operations func QuicEarlyDataHandler(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Vulnerability: An attacker can intercept and replay 0-RTT packets // containing POST/PUT/DELETE payloads, executing state mutations multiple times. next.ServeHTTP(w, r) }) } ``` #### Production Standard (Correct) > **Standard**: Validates the 'Early-Data' signal, isolates safe read-only methods from mutating methods, appends the mandatory 'Vary: Early-Data' header for proxy cache safety, and halts mutating requests with HTTP 425 (Too Early) alongside 'Retry-After: 0', forcing the client to resend after a full handshake. ```go package middleware import ( "net/http" ) // Strict0RTTReplayProtection enforces RFC 8470 anti-replay invariants on QUIC/HTTP-3 func Strict0RTTReplayProtection(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" if !isEarlyData { next.ServeHTTP(w, r) return } // Invariant: Always append 'Vary: Early-Data' to prevent cache poisoning w.Header().Add("Vary", "Early-Data") // Invariant: Non-idempotent/unsafe HTTP methods MUST NEVER run on 0-RTT data switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace: next.ServeHTTP(w, r) default: // RFC 8470 Section 5.2: Signal client to retry over full 1-RTT handshake w.Header().Set("Retry-After", "0") http.Error(w, "Too Early: 0-RTT early data rejected for state-mutating method", http.StatusTooEarly) } }) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard

Go Chi HTTP/3 QUIC 0-RTT Early-Data Anti-Replay Standard defines an industrial-grade behavioral standard for backend engineering. Enforces cryptographic replay attack mitigation on QUIC 0-RTT early data within Go Chi HTTP/3 services. Mandates strict HTTP method safety invariants (RFC 8470) and route-level validation to reject early-data execution of state-mutating handlers via HTTP 425 Too Early. Guarantees downstream cache coherence via explicit Vary header injection. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting State Mutations or Unvalidated Endpoints Over QUIC 0-RTT Early Data Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting State Mutations or Unvalidated Endpoints Over QUIC 0-RTT Early Data	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS attach an anti-replay middleware to the root Chi router before registering any mutating endpoints when running an HTTP/3 server.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.