Library · Network
Stopping replays: nonces, time and binding to the request
A valid request recorded once stays valid if the server does not remember seeing it. One-time nonces, a narrow time window and short sessions close this attack together.
The replay
The attacker does not need to understand the protocol. They record one successful sign-in and send it again, byte for byte, from another machine.
Three layers
- One-time nonces: the server remembers each nonce for a while and refuses it the second time.
- A time window: requests older than the window (for example 60 seconds) are refused, so nonces only need remembering that long.
- Bound to the device: signatures use the machine's own key, so a copied request cannot be re-signed elsewhere.
Clock drift
Client clocks are wrong sometimes. Do not widen the window; let the SDK learn the offset from the server once and retry.
Short sessions
How long is a leaked session id worth something? Short sessions with a steady heartbeat shrink that window.
With ClavisAUH
Nonces and the ±60 s window are always on, as Replay Protection. In Advanced Protection, turn on Short-Lived Session Lease so sessions lapse fast when a machine goes quiet.