Limited-use access tokens protect against request spoofing and replay attacks, ensuring that the action is performed by the intended recipient. You protect against these attacks by adding a unique token parameter to the request parameters and verifying it when the action is invoked.
Generate the token parameter as a key that can only be used for a specific action and a specific user. Before performing the requested action, verify that the token is valid and matches the one generated for the user. If the token matches, perform the action and invalidate the token for future requests.
Send access tokens to the user as part of the url property of the
HttpActionHandler.
For example, if your application handles approval requests at
http://www.example.com/approve?requestId=123, consider adding an
accessToken parameter and handling requests sent to
http://www.example.com/approve?requestId=123&accessToken=xyz.
The combination requestId=123 and accessToken=xyz must be generated in
advance; ensure that the accessToken cannot be deduced from the requestId.
Reject any approval request with requestId=123 and no accessToken or with an
accessToken not equal to xyz. After this request succeeds, reject any future
request with the same ID and access token.