title: Preventing replay REST url's replay attack
body: <p>I've spring security custom rest filter which authenticate client request using the below logic.</p>
  
  <p><strong>Header Fields</strong></p>
  
  <ol>
  <li>Date in header</li>
  <li>hmac hashed signature</li>
  </ol>
  
  <p><strong>Body</strong></p>
  
  <ol>
  <li>hmac encrypted data</li>
  </ol>
  
  <p>iOS client makes this request using POST and I have the expiration
   time set to 15 seconds in server.</p>
  
  <p>Now the question is, If anyone use debugging tools like Charles or
   something else and if he happens to put the breakpoints in url and
   fire the same with in 15 seconds, the nonce will be valid and server
   process the request for the second time. How can I prevent this from
   happening. In this case, nonce is not going to work.</p>
  
  <p>Whatever be the approach, if the hacker gets the final url that is
   about to be fired, it could be possible that he could fire it multiple
   times before the nonce expires......</p>
  
  <p>How can I prevent this from happening?</p>
  
  <p>Could anyone help me finding the best spring security implementation for this?</p>
  
  <blockquote>
    <p>Also, is HTTPS by default protects us from replay attack ? Do we need
    ssl client side validation ( having der format certificate in build
    and validate this with server certificate ) to make replay attack work with https
    ? or is it available in https by default ?</p>
    
    <p>In other words,  I am using AFNetworking, Do we need to use SSL
    Pinning to make use of https replay attack ? or will it work without
    ssl pinning?</p>
  </blockquote>