How does Timestamp helps in preventing Replay Attacks in webservices
security, timestamp, wcf, web, web-services
Solution
A timestamp by itself wouldn't be sufficient, but usually it is combined with a hashing mechanism to guarantee that the values haven't been tampered with.
The idea is that the client generates the parameters, and uses their private key to hash the parameters. The [hash + original values + public key] are then sent with the request. The server can use the public key to look up the private key, and ensure that the parameters are correct.
The timestamp is used, along with some threshold, to ensure that particular request can't be used more than once. If the threshold is small (a few hundred milliseconds) then a replay attack is virtually impossible.
Problem
I am trying to understand the concept of timestamps in request headers in web services but somehow still can't understand fully how it works. I would appreciate it if someone can explain the end-to-end use of timestamps in request and response of web services. Is it really a foolproof method of preventing replay attacks?