Replay attack
Reusing a captured request that was valid once, so the same payment, login, command, or other action happens again.
See it
What it is
A replay attack takes a request or message that was valid once and sends the same bytes again to repeat its effect. The attacker may not know the password or signing key at all. A captured signed transfer, door-unlock command, password-reset link, or webhook can be enough if the receiver checks authenticity but not freshness.
Use replay protection on signed API calls, webhooks, financial actions, device commands, and any one-time flow. Common controls are short timestamps, unpredictable nonces stored after use, monotonic sequence numbers, and idempotency keys whose first result is reused instead of running the action again. Stripe's webhooks are the concrete version: the Stripe-Signature header carries a t= timestamp inside the signed material, and the official libraries reject anything older than five minutes. TLS blocks passive capture in transit, but it does not stop a valid client, leaked log, or compromised endpoint from resending a request it already has.
The trap is checking the signature and assuming the job is finished. A signature proves who made the message and that it was not altered; it does not prove the message is new. Check the timestamp inside the signed material, reject identifiers already consumed, and make the recording atomic with the protected action so two simultaneous copies cannot both win.
Ask AI for it
Protect this signed endpoint from replay attacks. Sign the HTTP method, path, raw request body, Unix timestamp, and a 128-bit random nonce with HMAC-SHA-256. Reject timestamps more than five minutes from the server clock, compare the MAC with a constant-time function, and atomically insert each nonce into a database table with a unique constraint and a ten-minute expiry before performing the action. Return the stored result for a repeated idempotency key instead of executing twice. Add tests for an altered body, expired timestamp, reused nonce, reused idempotency key, and two concurrent copies of the same valid request.