what is used of nonce and timestamp in HMAC authentication
<p>I am using HMAC authentication to secure API. I have read that nonce and timestamps can be used to prevent replay attack. </p>

<p>But my question is attacker can modified the nonce and timestamp to current time and resend the API call again then how HMAC will prevent replay attack??</p>

<p>Thanks,</p>