How deeply does The Design of Web APIs, Second Edition cover replay attack?

Explains duplicate creation, unique request identifiers, conflict responses, business checks, and explicit duplicate confirmation.

Replay attack

As explained in The Design of Web APIs, Second Edition

Request replay is the repeated submission of a previously captured API request, potentially causing an operation to occur more than once.

A replay attack repeatedly submits a previously captured API request, risking duplicate operations and compromised data integrity. section 12.1.2 section 12.5

A retried order or transfer

If a consumer receives no response after POST /orders, it may retry and create a duplicate. For POST /transfers, a mobile user may retry after a technical error even though the server already processed the transfer. section 12.1.2 section 12.5.3

Prevent replay by combining request identity with business-aware duplicate checks:

Require a consumer-generated unique identifier, typically an Idempotency-Key UUID; reject a repeated identifier with 409 Conflict. section 12.5.3
Detect identical business data, such as amount, source, and destination, within a context-specific time window. section 12.5.3
Allow an intentional repeat through an explicit Confirm-Duplicate: true header. section 12.5.3

How The Design of Web APIs, Second Edition covers it

Cover of The Design of Web APIs, Second Edition

liveBook manning.com

Read The Design of Web APIs, Second Edition on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Software Security for DevelopersA replay attack is an attack in which a valid previously captured message or credential is retransmitted to obtain an unauthorized effect.
liveBook manning.com

Real-World CryptographyA replay attack resends a previously valid message and its authentication data so that they may be accepted again as current.

Compare how 3 books explain replay attack →

Related concepts

timestampaddressed by · A timestamp is a value representing a specific point in time, typically associated with an event, observation, or data item.
challenge-response authenticationaddressed by · Challenge-response authentication is an authentication method in which a claimant demonstrates knowledge of a secret or possession of a credential by producing a valid response to a verifier's challenge.
nonceaddressed by · A nonce is a value intended for one-time use within a specified cryptographic, authentication, or authorization context.

This explainer was generated by Manning's knowledge graph from the text of The Design of Web APIs, Second Edition. The section links point to the parts of the book it draws on.