I am trying to validate a JWT token received from Windows Azure. I am following the documentation here: https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-tokens/#validating-tokens
When you request a token Azure makes you supply a nonce, and the returned JWT token contains the nonce you sent, and you are supposed to make sure they match. A common problem in this situation is that the server is stateless and there may be multiple servers, so it is not easy to store the nonce for comparing to the value in the token when the token is received.
Here's what I am planning to do: When I redirect the browser to https://login.microsoftonline.com/ I will store the nonce in a cookie. When the token is received from Azure, and the browser sends the token to my server I will also get the nonce in the cookie and I can compare them to make sure they match.
This is an easy solution to the problem of where to store the nonce. But the question is, is this strategy consistent with how nonce is supposed to be used? Since the nonce is being transferred to/from the client, does that break the protection offered by nonce? Will this enable replay attacks and render the nonce worthless? To answer these questions I need to know what sort of attacks I am trying to prevent.
So the question is, what are some examples of replay attack scenarios the nonce is designed to prevent? Is the attacker somewhere on the Internet, in which case SSL can be used to prevent him from seeing any communication? Or is the attacker on the same computer as the user, i.e., after the user leaves the computer, the attacker uses the computer and the browser which the user neglected to close?
How exactly does a replay attack work?