Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is created it doesnt exist so I dont understand the reason for it.

Ideas. It gives possibility for the receiver to specify expiration time It takes unsynchronized machine time into account

share|improve this question

Often I've used the created timestamp as a way of proving uniqueness. The general assumption is that the granularity of the timestamp will be unique enough that a given receiver can assume that only one request with the timestamp or with a unique value that includes the timestamp will be received.

That would prevent some forms of replay attack, where an attacker gets a copy of an authenticated request and replays it at a later time to get updated information without having the necessary credentials.

share|improve this answer
It seems lik a non standard way of ensuring uniqueness. Do you think the point of the created date is for uniqueness? One could also just use the exiration timestamp – Stefan Rasmusson Nov 20 '13 at 7:19
One can use a lot of things - it depends on the specifics and the rules of expiration. For example, if your rule is "all things made today expire at midnight" then expiration is in no way unique. If the rules is "set expiration to 5 seconds after creation time according to the local server" - then creation and expiration will be very similar in uniqueness. – bethlakshmi Nov 20 '13 at 14:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.