So they're preventing replays by maintaining state? How's that stateless, then? Regardless, in truly stateless protocol, a replay attack shouldn't be a threa

So they're preventing replays by maintaining state? How's that stateless, then? Regardless, in truly stateless protocol, a replay attack shouldn't be a threat - who cares that someone can regenerate the same response from the same request? If it's really stateless, that replay can't _do_ anything. It turns into a threat when you put something stateful on top of this stateless machinery, which simply means that applications using this would need their own replay prevention. Isn't the right place to put the responsibility for preventing potentially dangerous erroneous state-transitions where you administer state in the first place - and not here?