Replay is the reuse of a captured token, session assertion, or other authentication artifact to impersonate a legitimate user or service without going through the login flow again. Because the attacker does not need the original password, replay attacks can succeed even when the stolen credential is short-lived or hidden from the victim.
In cloud and federated identity systems, replay matters because tokens often function as portable proof of prior authentication. If a bearer token is copied from logs, memory, browser storage, or network traffic, an attacker may present it to an API, SSO service, or application as if it were still legitimate. Defenses aim to make replay less useful through short lifetimes, tight validation, revocation, monitoring for unusual token use, and sender-constraining, which binds the token to proof of possession. The goal is to ensure that stealing a token is not the same as stealing access.