Glossary
Nonce
A nonce is a value generated for a single use and never legitimately repeated, included in a request specifically so the receiving system can detect and reject a resubmission of a request it's already seen. Without one, a captured request that was entirely legitimate the first time it was sent can often be replayed verbatim to trigger its effect again, with no need for the attacker to understand or forge anything about the request's actual content.
The mechanism only works if the receiving system actually tracks which nonces it's already seen and rejects a repeat, and if the nonce is large and unpredictable enough that an attacker can't simply guess the next legitimate one in advance. A nonce that's predictable or that nothing checks against previously-seen values provides no protection despite superficially looking like one.