The Webhook Bug That Lets Someone Pay Once and Get Access Twice
If your product delivery is triggered by a payment webhook, two things have to be airtight: (1) the signature is actually valid, and (2) a duplicated/retried webhook doesn't grant access a second time.
Most homemade webhook handlers get one of these wrong.
Constant-time signature checks, not naive string comparison
A naive signature comparison is timing-attackable. This microservice validates HMAC-SHA256 signatures in constant time, following the Standard Webhooks / Svix convention, and rejects any request older than 5 minutes (replay protection).
Idempotency via Redis
Every webhook carries a webhook-id. This service keys off that ID in Redis to guarantee idempotency — so a duplicated payment notification can't provision access twice.
Requirements: Python + Redis.
Status: 5/5 tests passing.
Honest limitation: this is a manual implementation of the standard — the official provider helper library wasn't published yet when this was built. It does not include your own business logic (provisioning, licensing, database writes) — that part is still yours.
Top comments (0)