425 Too Early

What does 425 Too Early mean?

The server will not process a request that arrived in TLS early data, because it could be a replay. It belongs to the 4xx Client Error class, which means the request contains bad syntax or cannot be fulfilled. Something about the request needs to change.

When do APIs return 425?

With TLS 1.3 zero round-trip resumption, where a client sends a request before the handshake has finished. Data sent that early can be captured and sent again by an attacker, so a server may refuse anything in it that is not safe to repeat.

How to fix a 425 Too Early

Send the request again once the handshake is complete. Clients that implement early data do this automatically. If you control the client, do not put non-idempotent requests in early data; if you control the server or CDN, early data can be switched off for the routes that must not be replayed.

Reproduce a 425 response

The fastest way to understand a status code is to trigger one and read the full response. Open the API tester and send a request to https://httpbin.org/status/425 — you will see the 425 status along with every response header the server sent. Comparing those headers against a working request is often what reveals the cause.

When you are debugging a real endpoint, check the response headers as carefully as the body, and confirm you are using the right HTTP method for the operation.

Related 4xx status codes

See also

• 421 Misdirected Request — The request reached a server that is not configured to answer for that host name.

References

• RFC 8470 — The specification that defines this status code.
• MDN: 425 Too Early — MDN's reference page for this status code.