Replay Attack Protection

Even a correctly signed request becomes dangerous if it can be captured and resent, because the signature alone doesn't prove the request is happening now versus five hours ago.

A nonce (a random, single-use value) tags each request as unique

A timestamp bounds how long a request is considered fresh — typically under 5 minutes

The server remembers recently-seen nonces and rejects any duplicate

This defeats an attacker who captured a fully valid, correctly-signed request off the wire

Want this flow explained in detail as it plays?

POST/api/wire-transfer

X-Nonce: a3f9c1d2-8b4e-4f6a-9c1d-2e8b4f6a9c1d

X-Timestamp: 1735689600

{ "toAccount": "ACC-88213", "amountCents": 500000 }

Defense in depth

First-seen nonce is cached server-side (e.g. in Redis) for the duration of the timestamp validity window
A repeated nonce is rejected immediately, regardless of a valid signature
Requests older than 5 minutes are rejected on timestamp alone, shrinking the cache needed

Vulnerable vs. Fixed

// DO NOT DO THIS
if (isValidSignature(req)) {
  processTransfer(req.body); // executes every time, even on a duplicate
}