4 ms·
Replay attacks are always gonna be possible unless you use a one time token or signature, thems the break's..., unless you wish to get into the something you ha
by shaydoc 13y ago
Replay attacks are always gonna be possible unless you use a one time token or signature, thems the break's..., unless you wish to get into the something you have and something you know model.
How can you do a use once token making concurrent requests without a strong authentication mechanism client side such as issuing private keys to clients....and all the PKI admin overhead.
I think its safe to say, that a restful api should be stateless, and bottlenecks such as session state are not necessary.
- gizzlon 13y agoI'll take that as a "yes" ;) AFAIK, neither signatures or "something you have, know" alone fixes replay attacks. Since this is a well known problem in cryptography, many solutions exists. All of which are probably overkill for this use.
- shaydoc 13y agoAt least with the use of a digital signature and nonce you can guarantee that the request hasn't been tampered with!