what the timestamp used for in Oauth

There is a timestamp in the Oauth authorization header. Anyone know what it 开发者_如何学Gois used for?

It is used (along with the nonce, which is randomly generated) to prevent replay attacks.

From http://hueniverse.com/2008/10/beginners-guide-to-oauth-part-iii-security-architecture/

To make implementations easier, OAuth adds a timestamp value to each request which allows the Service Provider to only keep nonce values for a limited time. When a request comes in with a timestamp that is older than the retained time frame, it is rejected as the Service Provider no longer has nonces from that time period. It is safe to assume that a request sent after the allowed time limit is a replay attack.