A valid payment webhook can still be dangerous to process twice
Payment providers retry. That is normal. What is not normal is what most applications do when the retry arrives. A valid Stripe, Midtrans, Tripay, or Xendit webhook can still be dangerous to process twice. The signature checks out. The payload is well formed. The provider is doing exactly what it promised. And the order state gets corrupted anyway. I built a small local lab to reproduce that…
Payment providers may retry webhook deliveries, which can lead to dangerous consequences if applications process the same webhook twice. Even if the signature checks out and the payload is well-formed, processing the webhook a second time can corrupt order state. This reporter built a local lab to reproduce and test the fixes for this issue.
The lab demonstrates five common problems that arise from double processing webhooks: duplicate delivery, out-of-order delivery, malformed payloads, timeouts during processing, and upstream failures after partial commits. To prevent these issues, the reporter recommends four concrete decisions: verifying the signature against the raw body, using idempotency based on event ID and payload hash, defining explicit order states, and implementing bounded retries with a review queue.
The lab includes 18 deterministic tests covering these failure modes and provides a replay path for operators to manually authorize webhook reprocessing. This approach allows developers to see failure modes without a live payment account and provides a solid foundation for handling payment webhooks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
