Can Nginx HTTP/3 0‑RTT Requests Process Authentication Headers First?

Goal

To guarantee that HTTP authentication or other stateful headers are examined before a 0‑RTT request is served, thereby preventing unauthenticated or replayed requests from reaching application logic.

Current Constraints

In Nginx 1.25+ the experimental http3 module accepts 0‑RTT data, but the implementation does not explicitly enforce header validation order. The same TLS certificate is used for both HTTP/2 and HTTP/3 on the port, and the module lacks support for streaming request bodies on POST/PUT.

Unresolved Behavior

It remains unclear whether Nginx guarantees header processing for 0‑RTT requests, and whether any configuration or patch can enforce this ordering.

Specific Questions

• Does Nginx currently process authentication headers before serving a 0‑RTT request, or are they handled after the response is generated?
• What configuration changes, if any, can force Nginx to validate headers first for 0‑RTT traffic?
• Is there a planned change in upcoming releases to address this ordering issue?