fix: skip nonce replay check for internal reads

server/internal_api.go

@@ -185,10 +185,12 @@ func authorizeInternalAPI(wrt http.ResponseWriter, req *http.Request, capability
 		writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "invalid internal signature", nil)
 		return false
 	}
-	requestClaim := internalRequestClaimValue(signingText)
-	if !claimInternalNonce(serviceName, nonce, requestClaim, time.Now().Add(window)) {
-		writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "internal nonce replayed", nil)
-		return false
+	if req.Method != http.MethodGet {
+		requestClaim := internalRequestClaimValue(signingText)
+		if !claimInternalNonce(serviceName, nonce, requestClaim, time.Now().Add(window)) {
+			writeIMError(wrt, req, http.StatusUnauthorized, 30043, imReasonAuthRequired, "internal nonce replayed", nil)
+			return false
+		}
 	}
 	return true
 }