TLS 1.3 0-RTT (Early Data) ve Anti-Replay Guvenlik Hesaplayici

Ag ve Istek Karakteristigi

Anti-Replay Savunma Modeli

Olcek ve Kume Yapisi

ssl_early_data ve map ile HTTP 425 Too Early dondurme.

# Nginx 1.25+ TLS 1.3 0-RTT ve Anti-Replay Yapilandirmasi
# /etc/nginx/conf.d/tls-0rtt.conf

ssl_protocols TLSv1.3;
ssl_early_data on; # 0-RTT Early Data'yi etkinlestir

# RFC 8470: Uygulamaya Early-Data basligini ilet
proxy_set_header Early-Data $ssl_early_data;

# Guvenlik Kurali: Eger istek Early Data ile geldiyse ve degistirici (POST/PUT/DELETE) ise
# veya sorgu parametresi iceriyorsa HTTP 425 (Too Early) dondur!
map $ssl_early_data $reject_early_data {
    "1"  $is_mutating_method;
    default 0;
}

map $request_method $is_mutating_method {
    POST    1;
    PUT     1;
    DELETE  1;
    PATCH   1;
    default 0;
}

server {
    listen 443 ssl;
    server_name api.siteniz.com;

    if ($reject_early_data) {
        return 425; # Istemci el sikismasini tamamlayip 1-RTT ile yeniden denemelidir
    }

    location / {
        proxy_pass http://backend_upstream;
    }
}

Caddy v2.8+ Early-Data baslik filtreleme ve 425 yaniti.

# Caddy v2.8+ TLS 1.3 0-RTT Yapilandirmasi
# /etc/caddy/Caddyfile

api.siteniz.com {
    tls {
        protocols tls1.3
        # Caddy otomatik olarak session ticket'lari guvenli sekilde dondurur
    }

    # RFC 8470 Korumasi: Mutating metodlarda Early Data reddi
    @replayRisk {
        header Early-Data 1
        method POST PUT DELETE
    }
    respond @replayRisk "Too Early - Replay Protection" 425

    reverse_proxy localhost:3000 {
        header_up Early-Data {http.request.header.Early-Data}
    }
}

Uygulama katmaninda mutating istekleri 425 ile koruma.

// middleware.ts (Next.js / Node.js RFC 8470 Replay Guard)
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  const isEarlyData = request.headers.get('early-data') === '1';
  const isMutating = ['POST', 'PUT', 'DELETE', 'PATCH'].includes(request.method);

  // Eger istek 0-RTT Early Data icinde gelmisse ve veritabanina yazma yapiyorsa:
  // Replay saldirilarini (cift para cekme / cift siparis) onlemek icin 425 dondur!
  if (isEarlyData && isMutating) {
    return new NextResponse('Too Early: Replay attacks not permitted on mutating endpoints.', {
      status: 425,
      headers: {
        'Retry-After': '0',
      },
    });
  }

  return NextResponse.next();
}