Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail

--- description: Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail - Enforces deterministic rejection of non-idempotent HTTP methods transmitted within TLS 1.3/QUIC 0-RTT early data frames across Go Chi microservices. Prevents replay attacks against stateful mutations by returning HTTP 425 Too Early, restricting 0-RTT processing strictly to safe, idempotent operations in compliance with RFC 8470 and RFC 9114. globs: **/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-quic-http3-0rtt-anti-replay-guardrail" --- # Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing stateful mutations (POST/PUT/PATCH/DELETE) on unvalidated QUIC 0-RTT early data ## System Constraints You are a Principal Security and Infrastructure Architect enforcing HTTP/3 and QUIC protocol compliance for Go Chi services. You must prevent 0-RTT replay vulnerabilities by enforcing RFC 8470 and RFC 9114 standards. Never allow state-changing HTTP requests to execute within 0-RTT early data. ## Strict Guidelines - Engineers MUST ALWAYS enforce an HTTP/3 early-data validation middleware on Chi root routers when QUIC 0-RTT is enabled. - Engineers MUST NOT allow non-idempotent or state-modifying HTTP methods (POST, PUT, PATCH, DELETE) to execute when `r.TLS.ReceivedEarlyData` is true or when the RFC 8470 `Early-Data: 1` header is present during early handshake phases. - Middleware MUST return HTTP status code `425 Too Early` immediately for unsafe requests received via 0-RTT, terminating request processing before context propagation or database interactions. - Code SHOULD include the `Early-Data` response header or appropriate downstream caching directives to signal clients that retry upon 1-RTT completion is expected. - Services MUST ensure that even idempotent methods (GET, HEAD, OPTIONS) permitted in 0-RTT do not produce state-modifying side effects in backend stores or cache tiers. ## Bad vs Good Implementations ### Chi Anti-Replay Middleware for QUIC HTTP/3 #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The HTTP/3 server accepts QUIC 0-RTT early data, but the Chi router directly processes non-idempotent POST operations without checking whether the request arrived in early data. An attacker can record the initial 0-RTT flight and replay it to duplicate fund transfers or state alterations. ```go package main import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) func setupRoutes() *chi.Mux { r := chi.NewRouter() // VULNERABLE: Direct mutation handling without 0-RTT check allows // an on-path adversary to capture and replay TLS 1.3 0-RTT ClientHello // and HTTP request packets, duplicating financial transactions. r.Post("/api/v1/transfers", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"transferred"}`)) }) return r } func main() { server := http3.Server{ Addr: ":443", Handler: setupRoutes(), } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ``` #### Production Standard (Correct) > **Standard**: The AntiReplayGuardrail middleware checks `r.TLS.ReceivedEarlyData` and standard `Early-Data` headers. Any unsafe HTTP method (POST, PUT, PATCH, DELETE) executed during 0-RTT is rejected with status 425 (Too Early), instructing compliant clients to retry only after the full 1-RTT TLS handshake completes. ```go package main import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) // AntiReplayGuardrail checks TLS state and RFC 8470 headers to reject unsafe 0-RTT mutations. func AntiReplayGuardrail(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := false // Check TLS 1.3 connection state for early data if r.TLS != nil && r.TLS.ReceivedEarlyData { isEarlyData = true } // Support RFC 8470 Early-Data header from upstream proxies/load balancers if r.Header.Get("Early-Data") == "1" { isEarlyData = true } if isEarlyData { switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions, http.MethodTrace: // Safe, idempotent operations are permitted next.ServeHTTP(w, r) return default: // RFC 8470 Section 5.2 / RFC 9114 Section 5.2.5 w.Header().Set("Retry-After", "0") w.WriteHeader(http.StatusTooEarly) _, _ = w.Write([]byte(`{"error":"Too Early: Replay mitigation active for 0-RTT"}`)) return } } next.ServeHTTP(w, r) }) } func setupRoutes() *chi.Mux { r := chi.NewRouter() r.Use(AntiReplayGuardrail) r.Post("/api/v1/transfers", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"transferred"}`)) }) return r } func main() { server := http3.Server{ Addr: ":443", Handler: setupRoutes(), } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail

Strict Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail defines an industrial-grade behavioral standard for backend engineering. Enforces deterministic rejection of non-idempotent HTTP methods transmitted within TLS 1.3/QUIC 0-RTT early data frames across Go Chi microservices. Prevents replay attacks against stateful mutations by returning HTTP 425 Too Early, restricting 0-RTT processing strictly to safe, idempotent operations in compliance with RFC 8470 and RFC 9114. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing stateful mutations (POST/PUT/PATCH/DELETE) on unvalidated QUIC 0-RTT early data Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing stateful mutations (POST/PUT/PATCH/DELETE) on unvalidated QUIC 0-RTT early data	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce an HTTP/3 early-data validation middleware on Chi root routers when QUIC 0-RTT is enabled.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.