title: How to check if nonce has been used?
body: <p>In my Rails 3.1.5 application, I am using the <a href="https://github.com/instructure/ims-lti" rel="nofollow noreferrer">ims-lti gem</a> to perform third-party authentication. To perform the authentication, three things must be done:</p>
  
  <ol>
  <li>Check that the request signature is correct</li>
  <li>Check if the timestamp is too old</li>
  <li>Check that the nonce has not been used</li>
  </ol>
  
  <p>The first two are done, but I am having trouble with the nonce check. Most questions I have found deal with generating nonces in Rails, not checking them.</p>
  
  <p>There are several related questions that use the <a href="https://github.com/pelle/oauth-plugin" rel="nofollow noreferrer">oauth-plugin gem</a> to check the nonce:</p>
  
  <p><a href="https://stackoverflow.com/questions/5811559/rails-oauth-plugin-multiple-strategies-causes-duplicate-nonce-error">Rails oauth-plugin: multiple strategies causes duplicate nonce error</a></p>
  
  <p><a href="https://stackoverflow.com/questions/5200240/oauth-signature-verification-fails">OAuth signature verification fails</a></p>
  
  <pre><code>return false unless OauthNonce.remember(nonce, timestamp)
  </code></pre>
  
  <p>Unfortunately, the oauth-plugin gem hasn't been updated since 2013, and is not compatible with the version of the oauth gem required by the ims-lti gem.</p>
  
  <p>It does not appear that the <a href="https://github.com/oauth-xx/oauth-ruby" rel="nofollow noreferrer">oauth gem</a> supports validating nonces.</p>
  
  <p>Is there a canned way to check the nonce, whether in native Rails or through a gem, or am I relegated to:</p>
  
  <ul>
  <li>Creating a nonce table</li>
  <li>Checking that the nonce is not already in the table</li>
  <li>Storing the nonce and timestamp in the table</li>
  <li>Cycling the table to drop entries with an expired timestamp</li>
  </ul>