I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.
I would like to create a page that decryption the current session's OpenID or WS-* token, and display it in a special diagnostic page. What should I expose and not expose to prevent a replay attack? I'm not concerned with information disclosure.
Is it sufficient to place it on a HTTPS page accessed using validated POST requests?
My intent in asking this question is to learn how valuable certain fields are in a given authentication response.