Replay attack
A replay attack is an attack in which previously captured valid messages, requests, or authentication data are retransmitted to produce an unauthorized effect.
Software Security for Developers
A replay attack is an attack in which a valid previously captured message or credential is retransmitted to obtain an unauthorized effect.
- How it is used
- Protects payments, OIDC authentication responses, magic links, and service-to-service requests from unauthorized reuse.
- How deep it goes
- Explains interception, repetition, tampering, nonces, timestamps, signatures, and one-time tokens without detailing cryptographic algorithms.
- Examples
- Uses repeated payment requests, tampered transfers, signed inventory requests, WebAuthn challenges, and reusable magic-link tokens.
- What you can do after
- Diagnose replay risk by checking request freshness, uniqueness, integrity, binding, and one-time credential invalidation.
Read how Software Security for Developers explains replay attack →
The Design of Web APIs, Second Edition
Request replay is the repeated submission of a previously captured API request, potentially causing an operation to occur more than once.
- How it is used
- Protects API data integrity when consumers retry operations after missing or unexpected responses.
- How deep it goes
- Explains duplicate creation, unique request identifiers, conflict responses, business checks, and explicit duplicate confirmation.
- Examples
- Uses retried orders and money transfers to demonstrate duplicate operations and uncertain server processing.
- What you can do after
- Operate/configure APIs with unique request identifiers, conflict handling, and business-level duplicate checks.
Read how The Design of Web APIs, Second Edition explains replay attack →
Real-World Cryptography
A replay attack resends a previously valid message and its authentication data so that they may be accepted again as current.
- How it is used
- Protects authenticated message exchanges from accepting previously valid messages as new.
- How deep it goes
- Explains the threat, counter defense, key rotation, nonce sequencing, and variable-length ambiguity without implementation detail.
- Examples
- Uses Alice-and-Bob message exchange, Rust HMAC code, TLS records, and replayable 0-RTT application data.
- What you can do after
- Diagnose replay exposure, add counter or nonce sequencing, and restrict 0-RTT to safely replayable operations.
Related concepts
- timestampaddressed by · A timestamp is a value representing a specific point in time, typically associated with an event, observation, or data item.
- challenge-response authenticationaddressed by · Challenge-response authentication is an authentication method in which a claimant demonstrates knowledge of a secret or possession of a credential by producing a valid response to a verifier's challenge.
- nonceaddressed by · A nonce is a value intended for one-time use within a specified cryptographic, authentication, or authorization context.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.