How to handle replay attacks in SSO using SAML ?

Hi Team, Can anyone help me to code "nonce" for my SAML SSO implementation ? This way I want to avoid the replay attacks ? Thanks.

Hi pjoshi, In order to avoid replay attacks, you can store the ID of the SAML messages already processed, to avoid processing them twice. Since the Messages expires and will be invalidated due that fact, you don't need to store those IDs longer than the time frame that you currently accepting.