code: def validate_timestamp_and_nonce(self, client_key, timestamp, nonce,
                                       request, request_token=None, access_token=None):
          
          raise self._subclass_must_implement("validate_timestamp_and_nonce")
docs: Validates that the nonce has not been used before.
  
          :param client_key: The client/consumer key.
          :param timestamp: The ``oauth_timestamp`` parameter.
          :param nonce: The ``oauth_nonce`` parameter.
          :param request_token: Request token string, if any.
          :param access_token: Access token string, if any.
          :param request: OAuthlib request.
          :type request: oauthlib.common.Request
          :returns: True or False
  
          Per `Section 3.3`_ of the spec.
  
          "A nonce is a random string, uniquely generated by the client to allow
          the server to verify that a request has never been made before and
          helps prevent replay attacks when requests are made over a non-secure
          channel.  The nonce value MUST be unique across all requests with the
          same timestamp, client credentials, and token combinations."
  
          .. _`Section 3.3`: https://tools.ietf.org/html/rfc5849#section-3.3
  
          One of the first validation checks that will be made is for the validity
          of the nonce and timestamp, which are associated with a client key and
          possibly a token. If invalid then immediately fail the request
          by returning False. If the nonce/timestamp pair has been used before and
          you may just have detected a replay attack. Therefore it is an essential
          part of OAuth security that you not allow nonce/timestamp reuse.
          Note that this validation check is done before checking the validity of
          the client and token.::
  
             nonces_and_timestamps_database = [
                (u'foo', 1234567890, u'rannoMstrInghere', u'bar')
             ]
  
             def validate_timestamp_and_nonce(self, client_key, timestamp, nonce,
                request_token=None, access_token=None):
  
                return ((client_key, timestamp, nonce, request_token or access_token)
                         not in self.nonces_and_timestamps_database)
  
          This method is used by
  
          * AccessTokenEndpoint
          * RequestTokenEndpoint
          * ResourceEndpoint
          * SignatureOnlyEndpoint