Never trust a payment webhook on its first word
A payment webhook is, structurally, a stranger sending your server a POST that says "this person paid." If your handler believes it, anyone who can reach that URL can mark orders as paid. In Saturdays , where PhonePe settles real money for food orders, the webhook handler is the most defensive code in the system — and every step in it exists because the step before it isn't enough. The handler…
Payment webhooks are often assumed to be trustworthy, but this can lead to significant financial risks. A webhook is simply a notification that a payment has occurred, but it does not guarantee that the payment has actually been processed correctly. When handling a webhook, there are several assumptions that must be considered: the request is authentic, the body has not been tampered with, the status indicates a successful payment, the amount matches the order, and the event has not already been processed.
Failing to verify each of these assumptions can result in lost revenue. The article outlines a five-step process for securely handling a payment webhook: 1) Log the raw request body before parsing, 2) Verify the authentication of the request to confirm it truly came from the payment gateway, 3) Independently re-query the payment status from the gateway to verify the event, 4) Lock the order row in the database and re-check the status under the lock to prevent duplicate processing, and 5) Compare the payment amount against the order's stored total and flag any mismatches for manual review.
The key principles are that the client never supplies the amount and that the endpoint that initiates the payment calculates the amount from the immutable order total. Throughout the entire sequence, no locks should be held across network calls and there should be a record of every step taken. By following this disciplined approach, payment processing systems can be made robust enough to handle real money transactions safely.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
