What is a replay attack on a trading webhook?
A replay attack resends a previously valid request. Unique signal IDs, timestamps/nonces, expiry windows and duplicate storage stop an old valid BUY from becoming a second unintended BUY.
What this means in practice
A replay attack resends a previously valid request. Unique signal IDs, timestamps/nonces, expiry windows and duplicate storage stop an old valid BUY from becoming a second unintended BUY. This page is specifically about “What is a replay attack on a trading webhook?”, so each scenario below is explained by its own mechanism instead of sharing one generic diagnosis.
Real-world scenarios
Scenario A — Captured BUY replay
A replay reuses a once-valid command. Combine unique signal ID with timestamp or nonce, expiry and a processed-command store so an old BUY cannot become a second live order. For Scenario A — Captured BUY replay on question 94, use that evidence specifically to answer “What is a replay attack on a trading webhook?”; keep it separate from the evidence for the other scenarios on this page.
Scenario B — Retry vs replay
Treat this as duplicate-delivery risk. If the first request was already persisted or queued before the error response, a resend must reuse the same signal ID and produce no second trading effect. For Scenario B — Retry vs replay on question 94, use that evidence specifically to answer “What is a replay attack on a trading webhook?”; keep it separate from the evidence for the other scenarios on this page.
Scenario C — Old signed message
A replay reuses a once-valid command. Combine unique signal ID with timestamp or nonce, expiry and a processed-command store so an old BUY cannot become a second live order. For Scenario C — Old signed message on question 94, use that evidence specifically to answer “What is a replay attack on a trading webhook?”; keep it separate from the evidence for the other scenarios on this page.
What to check
- TradingView alert log and exact send time
- HTTP status and receiver timestamp
- validated payload plus signal ID
- cTrader result only after transport is proven
Practical rule
For “What is a replay attack on a trading webhook?”, change only the first layer whose evidence no longer matches the intended action. Preserve signal identity, timestamps and final cTrader state, and reproduce execution-affecting changes on demo before live use.
Decision summary
Direct answer: A replay attack resends a previously valid request. Unique signal IDs, timestamps/nonces, expiry windows and duplicate storage stop an old valid BUY from becoming a second unintended BUY.
Next action: Match the observed evidence to one scenario above, test that mechanism independently on demo and keep the result traceable with one signal ID.
Primary sources
Need a TradingView → cTrader execution route?
NRUNO routes your TradingView instructions to cTrader. Your strategy and signal logic remain yours.