search

acquia / http-hmac-spec

An HMAC message format for securing RESTful web APIs.
81 stars 14 forks source link

Enforce a nonce #4

Closed cpliakas closed 8 years ago

cpliakas commented 9 years ago

From @pwolanin in #1:

Finally, there is no nonce value specified in the spec.

I would say every implementation must have a nonce even if the back-end doesn't currently track it.

cpliakas commented 9 years ago

@pwolanin I agree with you that this would be a good idea, but it would be helpful to explicitly state why this is a good idea even if the backend doesn't track it. Any references to articles or best practices supporting this request would be great.

cpliakas commented 8 years ago

Marking as fixed, a Nonce is enforced in the 2.0 sec.