title: Spring Boot API how to validate NONCE value sent in request header to avoid replay attacks
body: <p>I have a Spring Boot application with custom authentication. I am intercepting the API requests using Servlet Filter and validating the request token sent. I am also requesting <code>Nonce</code> in request header from client which is a unique value sent from client in every API call.</p>
  <p>I wanted to know if there is a standard way of checking Nonce received in header. I want to avoid replay attacks using Nonce.</p>
  <p>One implementation I can think of is - store Nonce received in requests for 1 minute / maintain LRU cache of 100 requests in memory and make sure its not received again.</p>
  <p>It would be helpful if you can point me to some good resources out there for good way of checking Nonce.</p>
  <p><strong>MySecurityFilter</strong></p>
  <pre><code>@Component
  @Order(1)
  public class MySecurityFilter implements Filter {
  
      private static final Logger LOGGER = LoggerFactory.getLogger(MySecurityFilter.class);
      private static final String NONCE_PARAMETER_NAME = &quot;x-nonce&quot;;
  
      @Override
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
              throws IOException, ServletException {
          HttpServletRequest req = (HttpServletRequest) request;
          String nonce = getHeaderValue(req, NONCE_PARAMETER_NAME);
                  
          //TODO: Validate Nonce
  
          chain.doFilter(request, response); 
      }
      //...
   }
  </code></pre>
  <p>PS: I am not using Spring security for API validation as its not required in my usecase.</p>