Glossary · Phase 8 · APIs
Replay attack
Recording a genuine message and sending it again later. Signed timestamps defend against it.
Including the time in what's signed blocks replay attacks. An attacker who copies one real webhook could otherwise resend it forever, like photocopying a valid ticket. You reject any message whose
tis more than a few minutes from now.
Try it now
Delivery is at least once. Handling the same event twice must do no harm.
Learn it properly
Webhooks and events · Push events to other systems: signed, retried and deduplicated. About 40 minutes.
Other terms from the same lesson
- SSRF: Tricking a server into sending requests to places it shouldn't, such as its own internal network.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.