NineAuthDocs
Core ConceptSecurity Infrastructure

Anti-Replay Protection

Anti-replay protection prevents attackers from intercepting legitimate network packets and re-transmitting them to spoof license activations, bypass device checks, or hijack active sessions.

Timestamp & Cryptographic Nonce Engine

Sensitive runtime endpoints require a millisecond timestamp and a unique 128-bit cryptographic nonce generated per HTTP request:

  • Timestamp Drift Window: Requests with timestamps diverging by more than ±60 seconds from UTC server time are rejected with 400 CLOCK_SKEW_DETECTED.
  • Nonce Single-Use Verification: Nonces are recorded in high-speed sliding-window key stores. Any repeated nonce within the validity window is dropped with 409 REPLAY_ATTACK_DETECTED.
replay-headers.sh
# Required runtime request headers:
x-nineauth-timestamp: 1724367000123
x-nineauth-nonce: a8f92b7c4d1e0f368291aa47bb12cc99
Built into SDKs
Official SDKs (Node.js, C#, C++) automatically generate and attach fresh nonces and synchronized timestamps on every outbound HTTP request.
Quickstart Guide →
See client headers and payloads in action with live examples.
Runtime API Reference →
Check all runtime endpoint header requirements.