The client sends the early_data extension and data immediately after ClientHello; the server may accept or reject it. An attacker who captures the first flight can replay it, possibly to many servers, so RFC 9846 §8 describes anti-replay mechanisms (single-use tickets, ClientHello recording, freshness checks) and recommends accepting only idempotent requests.
HTTP stacks typically allow 0-RTT only for safe methods such as GET and signal it with Early-Data: 1 and status 425 Too Early (RFC 8470). Early data is not forward-secret with respect to the resumption key. Many deployments simply disable it; QUIC supports the same mechanism.