Enhancing the get_salt interface: Implementing measures to prevent replay attacks

The current get_salt interface works by having the user input a JWT token provided by Google, which then returns a salt for authentication. However, this interface currently lacks measures to prevent replay attacks.

This means if an attacker can intercept a user's JWT token and replay it to the get_salt interface, they can obtain the salt. With the returned salt from the get_salt interface, the attacker can then impersonate the user and perform a series of operations. Therefore, measures to prevent replay attacks need to be added to the get_salt interface.

For instance, each JWT token could be used only once or each JWT token could be valid for a limited time. In this way, even if the attacker captures a user's JWT token, they can only use it once or within a limited time frame, thus preventing a replay attack.