Home / Knowledge hub / Replay attack
Knowledge hub
Replay attack
Capturing a valid request and sending it again to get the same result twice.
What it means
A replay attack is when someone takes a genuine request, message or token and sends it again. The server sees a correct signature, a valid session or a real token, and accepts it a second time. MITRE lists this as authentication bypass by capture-replay.
Nothing needs to be broken for it to work. The attacker does not learn a password or forge anything. They only need the server to be unable to tell the second copy from the first, which is a design gap rather than a coding slip.
Why it matters
Anything that changes state can be repeated: a payment, a refund, a transfer, a coupon redemption, a password change. A request that was meant to happen once can happen ten times, and each copy looks legitimate in the logs. The first sign is usually a balance that does not reconcile.
It also undermines signed messages. If a signed webhook from a payment provider is accepted twice, an order can be fulfilled twice. A valid signature proves who sent a message, not that it is new. That second property has to be checked separately.
How it shows up
You meet it wherever a request carries its own proof: bearer tokens, signed API calls, webhooks, one-time links and mobile app calls. The usual defences are a nonce the server remembers, a short timestamp window, an idempotency key, and tokens that are marked as spent once used.
The repeating mistakes are signed messages with no timestamp, one-time links that work again after use, and checks that look at the signature but never at freshness. Even TLS 1.3 early data can be replayed, which RFC 8446 warns about, so avoid it for requests that change state. Test by sending the same request twice and see what happens.
Questions people ask
Replay attack, answered
Does HTTPS stop replay attacks?
Not by itself. HTTPS stops someone on the network reading or changing traffic, but it does not stop a valid request being sent again by someone who obtained it elsewhere, such as from a log, a proxy or a compromised device.
Replay protection has to be built into the application as well.
What is the difference between replay and a man-in-the-middle attack?
In a man-in-the-middle attack the attacker sits between two parties and can read or change traffic as it passes. In a replay attack they only need a copy, and send it later.
The two combine often, but replay can happen long after the original request.
How do idempotency keys help?
An idempotency key is a unique value the client sends with a request. The server records it and returns the first result if the same key arrives again, instead of repeating the action.
It protects against accidental double clicks and deliberate replays of the same request.
Is a replay attack the same as token replay?
Token replay is one form of it, where the reused item is a stolen or captured token. Replay attack is the wider term and covers requests, messages and signed data too.
See token replay for the case where the token itself is the target.
How do we test for replay?
Capture a state-changing request, then send it again unchanged, and again after it should have expired. Try it with a used one-time link and a signed webhook payload.
If the second or third copy is accepted and changes something, that is a finding.
Related
Terms that sit next to this one
Token replay
Reusing a stolen or captured token to be accepted as its rightful owner.
Nonce
A value issued for a single use, so it cannot be replayed later.
Webhook signature
A check that an incoming webhook really came from the service it claims.
Man-in-the-middle attack
Someone sitting between two parties, reading or changing what passes between them.
Double spend
Using the same balance, credit or voucher twice by acting faster than your checks.
What happens on the second send?
Repeated requests, reused one-time links and signed messages accepted twice all sit in scope for us, and each finding arrives with the exact request that was replayed. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.