Signed API interactions are not replay resistent

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Observe an API call
2. Be able to permanently replay the observed API call (creation/update/delete)

% curl -k 'https://nxt-lookup.as59645.net/users?search=admin@nxt-30.as59645.net&exactCloudId=1'
[]
% curl -k -X POST -d @create_user.json 'https://nxt-lookup.as59645.net/users'                  
% curl -k 'https://nxt-lookup.as59645.net/users?search=admin@nxt-30.as59645.net&exactCloudId=1'
{"federationId":"admin@nxt-30.as59645.net","name":{"value":"admin","verified":0},"email":{"value":"wadawd@example.com","verified":0}}
% curl -k -X DELETE -d @delete_user.json 'https://nxt-lookup.as59645.net/users'                
% curl -k 'https://nxt-lookup.as59645.net/users?search=admin@nxt-30.as59645.net&exactCloudId=1'
{"federationId":"admin@nxt-30.as59645.net"}
% curl -k -X POST -d @create_user.json 'https://nxt-lookup.as59645.net/users'                  
% curl -k 'https://nxt-lookup.as59645.net/users?search=admin@nxt-30.as59645.net&exactCloudId=1'
{"federationId":"admin@nxt-30.as59645.net","name":{"value":"admin","verified":0},"email":{"value":"wadawd@example.com","verified":0}}
% cat create_user.json 
{"message":{"data":{"federationId":"admin@nxt-30.as59645.net","name":"admin","email":"wadawd@example.com","address":"","website":"","twitter":"","phone":"","twitter_signature":"","website_signature":"","verificationStatus":{"website":"","twitter":""}},"type":"lookupserver","signer":"admin@nxt-30.as59645.net","timestamp":1741528619},"signature":"mss1qTiz2LCnSg2NwZCLDeutc9S6ATnnIp+AfWe+tMJJpUnTQzOvdShZp8KwKFvhoNIQ7rC55p2aH5O1tQ32W1or\/yCgq7vj4RAswAmKgJH6WeyA2NyDnFlQrjOHQL1bhvOvaTFAE4qSV\/jI0BVbR9s+al4GvRsLzyZ00G0bhY34UDoM0X2X7xy5WEteZgG07UdHIV5nPItiABXrxwDPpLvxSgWHYH4k0SzM1k5R1U9mjVBQ64LMiIeliaVovbRKbBBvJGTMhjK24+ZAfJ8r8xG5IBYN01E6LWl\/oLb65U7QoWvSUoN\/tI\/uzfefXZoXjkzJWnDvJNSUc6FGn8GKpw=="}
% cat delete_user.json 
{"message":{"data":{"federationId":"admin@nxt-30.as59645.net"},"type":"lookupserver","signer":"admin@nxt-30.as59645.net","timestamp":1741527139},"signature":"oWu9+IpLt5LvzqHbyEsU2EY7J3HLD\/4tTI0hjKraNNWHpz49qTpa5eHQUX9sdtF1zkdB9yXv\/dHVIvkzDFkA97O3Z0qFaDFGS+MksrHboDPqcsBuCIiIVuClfDGfYAJPwdQ8RQ72fTLH\/7KvzbyVyv41Wiv7NTualA\/vQf\/aIJn5lCafXMKwq0LN1qIE9+mEfHoJwjLbbTFZJ+tg3DUu2zcQMzA8KteGyVmPCGdxl1QTTbVWMjOTFGaRvb6+kMF38jqwVJAcvK4wryg3tl7zzBhYGXTHIvj1iInO13\/WObHSnCzafJ0GOyG5upEGg\/KsprjNWjGw47tQOw36uaNLxg=="}

Expected behaviour

Signed API requests cannot be replayed.

Actual behaviour

Signed API requests can be replayed.

Notes

• This issue was found while debugging https://github.com/nextcloud/server/issues/51335
• This bug makes a great reproducer for https://github.com/nextcloud/lookup-server/issues/156

Begin with the curl reproduction using create_user.json and delete_user.json, then trace where signed requests are verified and their message timestamps are handled. Confirm the same signed creation and deletion requests are rejected on replay while a legitimate request still succeeds; the issue names no source files or tests.