Handling payment webhooks sounds straightforward—until network retries hit your server three times in a row, or an attacker intercepts a valid payload and tries to credit their balance twice.
Validating signatures is step one, but it won't protect you from a replay attack where a valid, signed payload gets resent. Here is how to set up a clean, multi-layer defense in Node.js with PostgreSQL to ensure every webhook payload runs exactly once.
Why Postgres for Idempotency?
You could store processed event IDs in Redis, but if your cache flushes or a container restarts during a high-traffic spike, you lose state.
Using PostgreSQL with a unique constraint guarantees database-level isolation. If two identical requests hit your backend at the exact same millisecond, Postgres handles the lock and drops the duplicate.
