When is it safe to enable TLS 1.3 0-RTT, and what must you forbid in that path?

When is it safe to enable TLS 1.3 0-RTT, and what must you forbid in that path?

0-RTT (zero round-trip time, RFC 8446 section 2.3) lets a resuming client send application data in its first flight, saving a round trip. The data is replayable by design, so enabling it is a request-routing decision, not a checkbox. Gating checklist.

— Enumerate which routes will accept early data. Only idempotent, side-effect-free requests qualify; a replayed POST that charges a card is a real attack, not a theoretical one.
— Confirm your stack signals early data to the application (nginx sets $ssl_early_data; pass it upstream as a header) so the backend can reject non-idempotent methods with 425 Too Early.
— Reject any state-changing method received in early data at the application layer, independent of server config.
— Verify anti-replay is on: bounded by the server's single-machine cache plus the obfuscated ticket age window; across a load-balancer fleet, replay protection weakens unless tickets are partitioned.
— Load-test resumption to confirm tickets are actually being issued and accepted.

Evidence vs. speculation: the round-trip saving is measurable; the replay risk is structural, not hypothetical.

Further reading: RFC 8446 sections 2.3 and 8; RFC 8470 (using early data in HTTP).

Bottom line: 0-RTT is safe only for the subset of requests you have explicitly proven idempotent.