About replay attack and defense

Replay attack

• Very vivid description , For example, catching something , Reposition to one side
• Specifically, it is
  • Requests are bugged or recorded
  • At some point in time , Make the same request again
  • After that, unexpected results are sent out
• The consequence is
  • Users consume many times
  • Login status is stolen
  • The order is abnormal
  • Lots of Raffles
  • Many times, etc
• The reason why the request will be replayed , Because the request was caught
• We can defend from the source

Related defense means

• Use encryption (https agreement )
• Requests are logged or retransmitted to invalidate
  • Time stamp
  • Use token(session) Authorized , Effective
  • Use nonce, A one-time solution
  • Use signature , Prevent timestamp and nonce Is tampered with