I read ~150 public Razorpay webhook handlers. At least 9 would process the same payment twice.
Razorpay delivers webhooks "at least once". Its own docs say the same event can arrive more than once and tell you to dedupe on x-razorpay-event-id . I wanted to see how often real code actually does that. Method. I pulled 247 public Python / JS / TS files on GitHub that reference Razorpay webhook events. A keyword scan flagged 48 candidates, and each one was then reviewed line by line. About 148…
Razorpay's webhook system can deliver the same event multiple times, making it crucial for developers to ensure their webhook handlers are idempotent. A reporter examined 148 publicly available webhook handlers on GitHub, finding that 6% (9 handlers) would process the same payment twice, leading to issues such as duplicate money transactions and duplicate records.
Most of the handlers failed to verify the webhook signature, leaving them vulnerable to fake deliveries. By implementing checks for event IDs and using UNIQUE constraints in a database, developers can create idempotent handlers that prevent duplicate processing and ensure the integrity of their payment systems.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
