425 Too Early means the server refused to process a request that might be replayed. It relates to TLS 1.3's 0-RTT "early data" feature.
0-RTT speeds things up by sending data before the handshake completes, but that data can be captured and replayed by an attacker. So for non-idempotent requests that are dangerous to re-run (payments, transfers), the server rejects early data with 425 and asks the client to retry after the handshake.
POST /transfer HTTP/1.1
Host: bank.example.com
Early-Data: 1
{"amount":1000}HTTP/1.1 425 Too Early
Content-Type: text/plain
Early data is not allowed for this request; retry after the handshake.# Refuse TLS 1.3 0-RTT early data for non-idempotent requests
location /transfer {
if ($ssl_early_data) {
return 425;
}
proxy_pass http://backend;
}