{
  "id": 12835445,
  "title": "Pin Duplicate-Delivery Receipts Before You Extract a Webhook Alias",
  "url": "https://urgent.news/2026/10/08/pin-duplicate-delivery-receipts-before-you-extract-a-webhook-alias",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-08T09:37:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/webx_2736/pin-duplicate-delivery-receipts-before-you-extract-a-webhook-alias-4d71"
  },
  "original_language": "en",
  "account": "A billing module that verified webhook signatures and recorded deliveries into a ledger faced an issue during cleanup. Duplicate detection code remained in an older file, leading to a replayed event inserting a second ledger row. This failure was not due to a weak signature algorithm or a missing test, but rather a consequence of callers relying on a duplicate contract for repeated event IDs. To prevent this issue, production logs often show three rules: a repeated event ID must return the first outcome and skip a second ledger write; signature header names can arrive under various aliases, with only a known alias allowed to pass; and raw body bytes are hashed before JSON parsing, with key order not affecting the stored receipt. To avoid breaking these rules, receipts should be stored before any changes to the code. A proposed test suite keeps the first suite to four fixtures, each containing one receipt row with event ID, alias used, SHA-256 of raw body, and outcome label. These fields include accepted, duplicate, and rejected outcomes. The test set consists of a valid delivery with the primary signature alias and an unseen event ID, the same raw bytes and event ID sent again to ensure duplication, an unknown alias that must be rejected without adding a ledger row or expanding the seen set, and a known alias with a signature fragment that does not match the raw body hash prefix. Extra rows should only be added after incidents demonstrate that the four fixtures do not cover the behavior. The goal is to create a stable pin for the extract, not a growing archive of provider quirks.",
  "summary": "Consider a billing module that verified webhook signatures, parsed event JSON, and inserted a ledger row for every accepted delivery. During a routine cleanup, the verifier moved into a new file while duplicate detection stayed in the old one. A replayed event then inserted a second ledger row, because the new boundary never received the prior event id. Treat that replay as an illustrative…",
  "key_points": [
    "Duplicate event IDs cause second ledger row insertion",
    "Signatures can arrive under various alias names",
    "Receipts must be stored before any code changes"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}