New answers tagged nonce
Based on your comments it sounds like S is passing some encrypted or signed access token to P that it passes to H. H can decrypt or verify the token is authentic and use the information contained within to determine of P is allowed to perform the app. That sounds great. I'm not sure that you need a nonce here if all you are trying to do is prevent replay. ...
Top 50 recent answers are included