Show HN: WebSession, a Secure Replacement for Cookies
The only thing in this protocol that prevents the reuse of Authorization header is keeping track of nonce:<p>> Validating that the nonce has not been used already for this session. Important: at this point, the nonce should be added to the ‘seen’ set, because nonces should be invalidated whether the signature validation passes or fails. Failure to do so can allow attackers to brute-force a valid signature for a single nonce.<p>That's one extra db row / kv pair for every single request, including read requests, for very little benefit.<p>Request signatures incorporating timestamp and optionally path/payload are stronger, can be statelessly validated, and are already in use today on certain sites.