Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail

--- description: Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail - Protects state-mutating HTTP/3 endpoints from transport-level replay attacks enabled by TLS 1.3 / QUIC 0-RTT early data. Unvalidated early data lacks transport replay protection, allowing captured initial flight packets to execute side effects multiple times unless rejected with HTTP 425 (Too Early) or gated behind strict idempotency controls. globs: **/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/go-chi-quic-zero-rtt-anti-replay-guardrail" --- # Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail > **Severity**: CRITICAL | **Category**: backend > **Anti-Pattern Warning**: Executing state-mutating requests arriving via QUIC 0-RTT early data without replay rejection or validation ## System Constraints You are a Principal Security and Network Architect enforcing RFC 8470 and RFC 9114 standards for Go applications using Chi and QUIC/HTTP/3. Mandate strict 0-RTT early data protection to eliminate replay attack vulnerabilities on state-changing endpoints. ## Strict Guidelines - Engineers MUST ALWAYS inspect HTTP/3 early data indicators (context connection state or the RFC 8470 'Early-Data: 1' header) before dispatching to state-mutating handlers. - Engineers MUST NOT allow non-idempotent HTTP methods (POST, PUT, PATCH, DELETE) to proceed if received in 0-RTT early data frames. - Services MUST respond immediately with HTTP 425 (StatusTooEarly) when a non-safe HTTP request is received over 0-RTT early data, forcing the client to replay after the 1-RTT handshake completes. - Code SHOULD enforce global or route-group Chi middleware ensuring early data is stripped or validated before reaching business logic. - Components NEVER execute financial transactions, inventory decrements, authentication exchanges, or database mutations within unauthenticated 0-RTT early data flights. ## Bad vs Good Implementations ### Vulnerable vs. Protected Chi HTTP/3 0-RTT Handler Setup #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The HTTP/3 Chi server accepts early data without checking if requests arrived in 0-RTT frames. Attackers who capture the initial QUIC flight can replay POST /api/v1/payments, causing duplicate balance deductions. ```go package main import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) func main() { r := chi.NewRouter() // ANTI-PATTERN: State-mutating routes mounted directly without checking 0-RTT early data status. // Adversaries can capture 0-RTT packets and replay them against HTTP/3 endpoints, // triggering duplicate payments or mutations before 1-RTT TLS handshake completion. r.Post("/api/v1/payments", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"payment_processed"}`)) }) server := http3.Server{ Handler: r, Addr: ":443", } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ``` #### Production Standard (Correct) > **Standard**: The AntiReplayEarlyData middleware intercepts requests before routing. If an incoming request uses 0-RTT early data and invokes a non-safe HTTP method (e.g., POST), it immediately terminates the request with HTTP 425 StatusTooEarly, instructing RFC 8470-compliant clients to retry once the 1-RTT TLS handshake finishes. ```go package main import ( "net/http" "github.com/go-chi/chi/v5" "github.com/quic-go/quic-go/http3" ) // AntiReplayEarlyData enforces RFC 8470 and RFC 9114 compliance. // Non-safe HTTP methods received as 0-RTT early data are rejected with 425 Too Early. func AntiReplayEarlyData(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { isEarlyData := r.Header.Get("Early-Data") == "1" // QUIC/HTTP/3 contexts often provide connection state directly; // fallback/augment with context check if supported by transport: if !isEarlyData { if isEarly, ok := http3.IsEarlyData(r); ok && isEarly { isEarlyData = true } } if isEarlyData { switch r.Method { case http.MethodGet, http.MethodHead, http.MethodOptions: // Safe, idempotent operations may proceed default: // Reject state-mutating operations with 425 Too Early w.Header().Set("Retry-After", "0") w.WriteHeader(http.StatusTooEarly) w.Write([]byte(`{"error":"too_early","message":"state mutations forbidden during 0-RTT handshake"}`)) return } } next.ServeHTTP(w, r) }) } func main() { r := chi.NewRouter() r.Use(AntiReplayEarlyData) r.Post("/api/v1/payments", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusCreated) w.Write([]byte(`{"status":"payment_processed"}`)) }) server := http3.Server{ Handler: r, Addr: ":443", } _ = server.ListenAndServeTLS("cert.pem", "key.pem") } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail

Go Chi HTTP/3 0-RTT Early Data Anti-Replay Guardrail defines an industrial-grade behavioral standard for backend engineering. Protects state-mutating HTTP/3 endpoints from transport-level replay attacks enabled by TLS 1.3 / QUIC 0-RTT early data. Unvalidated early data lacks transport replay protection, allowing captured initial flight packets to execute side effects multiple times unless rejected with HTTP 425 (Too Early) or gated behind strict idempotency controls. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Executing state-mutating requests arriving via QUIC 0-RTT early data without replay rejection or validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Executing state-mutating requests arriving via QUIC 0-RTT early data without replay rejection or validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS inspect HTTP/3 early data indicators (context connection state or the RFC 8470 'Early-Data

Engineers MUST ALWAYS inspect HTTP/3 early data indicators (context connection state or the RFC 8470 'Early-Data: 1' header) before dispatching to state-mutating handlers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.