I am looking at implementing an authentication module using OAuth 2.0 Client and I am trying to avoid having any server state. I was going thorough a few other questions
It seems like implementing a nonce requires storing something on the server to ensure that replay attacks do not happen because the request should not occur twice.
However, this is only for authentication/authorization not for form submission data in which case implementing a nonce is easy as I would need to have server state anyway to capture the data.
So the more I look at it, it does not seem to make sense to use a nonce in this use case (except for the login, but that's the Authorization server's problem), the token (encrypted with a secret key that is on the server based on the client_secret of OAuth) I have should be fine to send (until it expires).
Is there something that I may be missing?