INVALID_TOKEN
QUIC INVALID_TOKEN (0x0b) is sent when the server receives an Initial packet containing a token that cannot be validated. QUIC tokens are used for address validation and 0-RTT. A token that is malformed, expired, or cryptographically invalid causes the server to reject the connection.
Code
0x0b
Decimal
11
Standard
RFC 9000 §20
Description
QUIC supports address validation tokens that allow the server to avoid a round-trip for verified clients. On a new connection, the client may include a token from a previous connection (provided via NEW_TOKEN) or from a Retry packet. The server validates this token to confirm the client's IP address ownership. If the token's HMAC does not verify, the token's validity period has expired, or the token was issued for a different client address, the server sends INVALID_TOKEN. The client should retry the connection without a token, accepting that a full address validation round-trip will occur. 0-RTT tokens also use this mechanism. A client attempting 0-RTT with an expired or revoked session ticket may receive INVALID_TOKEN if the server cannot validate the resumption credentials embedded in the token.
Common Causes
- –Token's HMAC verification failed (token was corrupted or forged)
- –Token expired – validity period elapsed since issuance
- –Token issued for a different client IP address
- –Retry packet token not from the current connection attempt
- –Session ticket embedded in 0-RTT token is invalid