Backend & systems·Security and identity
somebody captures a valid signed request and sends the exact same bytes again an hour later, and it still works.
Replay attack
Re-sending a previously valid message to repeat its effect. Signatures alone do not prevent it, since the replayed request is genuinely valid. The defences are a timestamp with a tight window, a nonce the server remembers, or making the operation idempotent so a replay changes nothing.