title: Does OAuth 2 use nonce?
body: <p>I don't see it mentioned anywhere in the 2.0 spec, is nonce not used by OAuth 2 and if not, now does it prevent replay attacks?</p>
  <p>The <a href="https://www.rfc-editor.org/rfc/rfc5849#section-3.3" rel="nofollow noreferrer">1.0 spec</a> states:</p>
  <blockquote>
  <p>3.3. Nonce and Timestamp</p>
  <p>The timestamp value MUST be a positive integer. Unless otherwise specified by the server's documentation, the timestamp is expressed in the number of seconds since January 1, 1970 00:00:00 GMT.</p>
  <p>A nonce is a random string, uniquely generated by the client to allow the server to verify that a request has never been made before and helps prevent replay attacks when requests are made over a non-secure channel. The nonce value MUST be unique across all requests with the same timestamp, client credentials, and token combinations.</p>
  <p>To avoid the need to retain an infinite number of nonce values for future checks, servers MAY choose to restrict the time period after which a request with an old timestamp is rejected. Note that this restriction implies a level of synchronization between the client's and server's clocks. Servers applying such a restriction MAY provide a way for the client to sync with the server's clock; alternatively, both systems could synchronize with a trusted time service. Details of clock synchronization strategies are beyond the scope of this specification.</p>
  </blockquote>