The field guide · rule 08 of 16
Prove who is asking
Every request should prove who sent it, and that it was not changed or sent again.
What it means
A request arriving at your system should prove who sent it, that nobody changed it on the way, and that it is not an old request being sent again. Common tools are signed messages, one-time codes and timestamps. Secret checks should take the same time whether a guess is close or not, so attackers learn nothing from the timing.
What goes wrong without it
Someone copies a valid request and sends it again an hour later, and the system acts on it twice.
How I build it
- People sign in to my chain-intelligence service by signing a one-time message with their wallet. The server checks it, then deletes it so it cannot be used again. There are no passwords at all.
- Services in my systems sign each request with a timestamp, and anything more than a few minutes old is refused.
- My language tutor checks its private-access cookie with a comparison that takes the same time for every guess.
Ask your team
- Does every service check who is calling it?
- Would an old, copied request be refused?
- Do sign-in links and codes work only once?
How a review checks this
A review checks how each entry point knows who is calling, and tries an old request again to see if it is refused.
Request a reviewThe offer: Architecture reviewCheck your system in one minute