Glossary
Replay Attack
A replay attack captures a legitimate request — often one that was never even encrypted improperly, just observed in transit or logged somewhere accessible — and resubmits it later to repeat whatever effect it originally had. The attacker doesn't need to understand, forge, or decrypt anything about the request's actual content; an exact, unmodified copy is sufficient if nothing about the receiving system detects that this exact request has already been processed once.
This is precisely what a nonce, a strictly increasing sequence number, or a tightly bound expiry defends against: some property of the request that changes or becomes invalid after first use, so a captured copy from an earlier moment fails a check the original, first submission passed.