4 ms·
Adding a nonce to the request and storing it is a good idea to add to prevent replay attacks. Especially in the case of OAuth where some implementations hash t
by jakejake 11y ago
Adding a nonce to the request and storing it is a good idea to add to prevent replay attacks. Especially in the case of OAuth where some implementations hash the query string but don't hash the request body - which could allow all kinds of mischief without even cracking the secret key.
- thenrich99 11y agoIn this scenario a replay attack is limited to a 30s window during which the timestamp is valid. Depending on the implementation, this may or may not suffice, in which case an nonce would definitely be an improvement albeit with the added complexity.