Replay attack
Reuse of a previously valid message or credential to cause an unintended repeated operation. Message authenticity alone does not establish freshness.
- Defined in
- NIST glossary: replay attack
Covered in
Verify webhook deliveries before acting
Verify the provider’s signature over the correct bytes, then apply replay, authorization, and idempotency controls before a business action.
Passkeys and MFA: WebAuthn enrollment, sign-in and replacement
Register, verify and replace passkeys with WebAuthn so phishing resistance survives the account’s whole lifecycle, and map passkeys and other MFA methods to the NIST SP 800-63B-4 assurance levels.
Defend JWTs against forgery, confusion and replay
Verify a JWT as an issuer-, type- and audience-bound assertion with an algorithm allowlist and trusted keys, closing the alg "none", key-confusion, header-injection, weak-secret and replay attacks.
Practice: Webhook signature and replay lab: Repair a webhook handler that pays twice · JWT verification lab: Verify a JWT before trusting it