Bound API Replay Windows
Set a clear validity window and duplicate policy for signed API requests.
A signed request can be authentic and still be stale or repeated. A timestamp, nonce, or idempotency record may limit reuse, but each has different failure modes. Choose a replay policy that fits the action and clock behavior. Do not copy a short window from another product without testing client retries and delayed delivery.
Replay-state table
| Request state | Expected decision |
|---|---|
| First valid request | Process once |
| Identical retry inside window | Return documented prior outcome |
| Same ID with changed body | Reject as conflict |
| Expired request | Reject before side effect |
| Future timestamp outside tolerance | Reject |
| Missing signature or ID | Reject protected operation |
Record the exact bytes that the signature covers and where the replay key is stored. If the body can be normalized in two ways, define which representation is signed. A distributed service needs a shared replay store or another mechanism that works across instances. A local process cache may fail after a restart.
Test delivery conditions
Use a synthetic action in staging. Send one valid request, an identical retry, a changed payload, and a request outside the configured time window. Check storage, queued jobs, and notifications after each. Test clock skew within the stated tolerance and a worker restart. Do not create destructive calls merely to prove the policy.
The OWASP REST Security Cheat Sheet covers API request protection, and OWASP ASVS supplies a verification frame. This state table is the local contract for duplicate effects. Keep replay protection separate from authorization: a valid signature from a client does not grant access to an unrelated tenant resource. If the store is unavailable, protected state-changing calls should fail safely rather than proceed without the replay check.
A timestamp without a shared replay record cannot stop an identical signed request inside the valid window. Choose a nonce, event ID, or idempotency key and state how instances share its used state. Test the behavior after a worker restart.
Find the gaps in your access controls
See how an illustrative cross-workspace finding connects evidence, impact and a fix. Discuss the tenant boundaries your team needs reviewed.