How I Stop Webhook Replay Attacks in Node.js & PostgreSQL
Handling payment webhooks sounds straightforward—until network retries hit your server three times in a row, or an attacker intercepts a valid payload and tries to credit their balance twice. Validating signatures is step one, but it won't protect you from a replay attack where a valid, signed payload gets resent. Here is how to set up a clean, multi-layer defense in Node.js with PostgreSQL to…
Webhooks from payment providers can be straightforward, until network retries or malicious actors attempt multiple deliveries. Validating signatures alone is not enough to protect against replay attacks. The solution is to implement multi-layer defense in Node.js with PostgreSQL for truly idempotent processing. Storing processed events in Redis is not ideal, as cache flushes or container restarts could erase state. PostgreSQL provides robust guarantees against this.
To track processed webhook events, create a table with a unique constraint on the event_id column. This ensures database-level isolation, preventing duplicate rows even if two identical requests arrive at the same millisecond. An index on event_id enables fast lookups for incoming events.
In the Express middleware, three security checks are performed before touching the request payload. First, check that the request timestamp is within 5 minutes to prevent stale replay attempts. Next, validate the HMAC signature using crypto.timingSafeEqual to avoid timing side-channel attacks. Finally, query PostgreSQL for existing records with the same event_id. If no duplicate is found, proceed with processing; otherwise, reject the request.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
