Question

I’ve written a web service which outputs some (sensitive) data to strongly authenticated clients.

I’ve been asked to let any single request to work only once, to avoid any security risk 🙁

I’m asking myself:

• does this requirement makes any sense to you?
• if it does, how would you accomplish this? I would like – if possible – to avoid to have to keep a requests archive…
• if it can be of any use, the language choosen for the application on server is perl.

Answer 1

I would need to more information about the service to determine if it makes sense or not. However I don’t think is possible to prevent duplicate requests without keeping some kind of log. Maybe you could SHA hash the request and store that in a table to compare future request hashes?