Authenticity does not stop replay
05A valid signed message can be copied and submitted again.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 10.10 ↗
RFC 7515 · § 10.10EXAMPLE
3 / 3
03
Application replay check
A suitable nonce, timestamp, or message identifier policy rejects repeats.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
JWS does not inherently prevent replay.
- JWS does not inherently prevent replay.
- Applications need appropriate freshness or uniqueness checks.
- The signature authenticates bytes; it does not establish that an action has not already occurred.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy