← All posts
Security
Why we still do not enable TLS 1.3 0-RTT by default
Zero round-trip resumption shaves a full round trip off repeat visits, but it comes with replay risks. Here is how we think about the trade-off.
TLS 1.3 0-RTT lets a returning client send its first request together with the handshake. On a 100 ms mobile connection that is a noticeable improvement.
The replay problem
Early data can be replayed by an attacker who captures it. For a GET of a static file that is harmless; for a request that changes state it is not.
Our approach
We accept early data only for safe methods on paths the customer marks as idempotent, and we forward the Early-Data: 1 header so origins can reject anything they are unsure about.