How can an engineer mitigate simple replay attacks against a REST API used for brute-force attempts?

Adding a timestamp to the API request header helps mitigate simple replay attacks. The server can then check if the timestamp is within an acceptable, recent window. If an attacker replays an old request, the server will reject it because the timestamp is no longer valid. This prevents an attacker from repeatedly sending the same valid request to perform brute-force attempts. Using a password hash protects the password itself, not against replay attacks where the entire request (including a valid password) is replayed. Adding OAuth provides authentication and authorization, but doesn't inherently prevent a valid, authenticated request from being replayed if not combined with other mechanisms like nonces or timestamps. HTTPS encrypts the communication, preventing eavesdropping and tampering, but it does not prevent an attacker from capturing an encrypted, valid request and replaying it.