HTTP 401 Unauthorized vs 425 Too Early
Both HTTP 401 (Unauthorized) and 425 (Too Early) belong to the 4xx Client Error category. 401 indicates that the request requires user authentication. The response includes a WWW-Authenticate header indicating the authentication scheme. Meanwhile, 425 means that the server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT).
Description
The request requires user authentication. The response includes a WWW-Authenticate header indicating the authentication scheme.
When You See It
When accessing a protected resource without credentials or with expired tokens.
How to Fix
Include valid authentication credentials (API key, Bearer token, Basic auth) in the Authorization header.
Description
The server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT).
When You See It
When a server rejects a request sent as TLS 1.3 early data due to replay risk.
How to Fix
Retry the request after the TLS handshake completes.
Key Differences
HTTP 401: The request requires user authentication. The response includes a WWW-Authenticate header indicating the authentication scheme.
HTTP 425: The server is unwilling to risk processing a request that might be replayed. Used with TLS 1.3 early data (0-RTT).
You encounter 401 when when accessing a protected resource without credentials or with expired tokens.
You encounter 425 when when a server rejects a request sent as TLS 1.3 early data due to replay risk.
When to Use Which
For 401 (Unauthorized): Include valid authentication credentials (API key, Bearer token, Basic auth) in the Authorization header. For 425 (Too Early): Retry the request after the TLS handshake completes.