Nonce.

A nonce defeats replay. The attacker captures a legitimate signed response (an ID Token, a SAML assertion, an authentication challenge response) and replays it later; the verifier rejects it because the nonce binds the response to a specific earlier request that no longer exists in the verifier's session state.

The common implementation bug is generating the nonce but never verifying it on the return. The signature checks out, the token validates, and the developer ships — and the system silently accepts replayed tokens. Use a library that enforces nonce verification by default; if the library does not, write the check yourself and gate authentication on it.