Why a captured Android request fails in Python

What the copy actually holds

A copied request is a snapshot: a method, a path, a set of headers, a body, each fixed at the instant you captured them. The server validated that instant. Your reproduction is a different instant, and the app is built so that a different instant needs a different request.

The values that change between the capture and your replay are usually a small set. The timestamp. A nonce. A session or a token. A device-derived value. The signature that covers some combination of the rest.

Where the replay breaks

Arrange the copy next to what the app actually emits and the missing state is usually one of four things.

• A signature over changing fields - the app signs the method, path, body, a timestamp and a nonce. The copy carries the signature for the moment you captured it; your replay has a fresh timestamp and body, so the signature no longer matches.
• A value re-derived per call - a nonce, a request id, or an obfuscated identifier is generated for each request. Copying a past value makes the server treat the call as a replay.
• A date-bearing header - X-Timestamp, Date, or an HMAC computed over a window. A stale value is rejected out of hand.
• Session or token state - the request is bound to a token that was valid then and has since changed, or that is device-scoped.

How to confirm which one it is

Change one input at a time. Replay the capture byte-for-byte and record the status as the baseline. Then regenerate one input and re-sign over the new canonical string, because if the signature covers the field you changed, a stale signature makes the test fail for the wrong reason. The step at which the server starts accepting the request tells you which state the app recomputed.

# the canonical string is what the app signs; re-sign after every change
ts = str(int(time.time()))
nonce = secrets.token_hex(8)
payload = json.dumps(body, sort_keys=True).encode()

def sig():
  canonical = f"{method}\n{path}\n{ts}\n{nonce}\n".encode() + payload
  return hmac.new(key, canonical, sha256).hexdigest()

# baseline: the exact capture
r = requests.get(url, headers=frozen_headers); print(r.status_code)   # 403

# fresh timestamp, re-signed
headers["X-Timestamp"] = ts
headers["X-Signature"] = sig()
r = requests.get(url, headers=headers); print(r.status_code)

# fresh nonce, re-signed
nonce = secrets.token_hex(8)
headers["X-Nonce"] = nonce
headers["X-Signature"] = sig()
r = requests.get(url, headers=headers); print(r.status_code)

Reproducing the generation

Once you know which fields regenerate, find where the app computes them. The signing logic is usually in an interceptor (OkHttp, Retrofit), in a helper class, or in a native library. The nonce and timestamp generation is often right next to it. Read what the app signs, in what order, with what encoding, and rebuild that exact operation.

# reproduce the generation, not the capture
ts = str(int(time.time()))
nonce = secrets.token_hex(8)
payload = json.dumps(body, sort_keys=True).encode()

canonical = f"{method}\n{path}\n{ts}\n{nonce}\n".encode() + payload
sig = hmac.new(key, canonical, sha256).hexdigest()

r = requests.post(base + path, data=payload,
    headers={"X-Timestamp": ts,
             "X-Nonce": nonce,
             "X-Signature": sig})

The sign of a real replay problem

The part that actually matters

The failing reproduction is the symptom. The fix is never "copy harder". It is finding the one or two values the app regenerates and rebuilding them the way the app does. Once the request recomputes its own state, it behaves the way the app behaves.

A captured request is a frozen frame. A working reproduction recomputes the frame.