How idempotency prevents duplicate payments when webhooks are resent

·1 views

Payment gateways like Stripe, Mercado Pago, and PagSeguro automatically resend webhook events when they do not receive a 2xx response in time, which can happen due to timeouts, deploys, or slow processing. If a backend system treats every incoming webhook as a new event, it can create duplicate payments, release access twice, and send multiple confirmation emails to the same customer. The root cause is non-idempotent code that performs a fresh database insert on every request, regardless of whether the event was already processed. The fix involves storing each unique event ID in a dedicated database table with a unique constraint, then attempting an INSERT rather than a SELECT check to safely handle race conditions. If the insert fails due to a duplicate, the system returns a 200 response immediately, signalling the gateway to stop retrying without reprocessing the event.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How to Prevent Duplicate SMS Password-Reset Alerts Under Timeout and Retry Conditions

Duplicate SMS password-reset notifications can occur when developers treat a timed-out request as a failed send and immediately retry, rather than as an unknown outcome. A robust approach requires persisting an idempotency key and expiry before dispatch, then delegating retries to a background worker that can reconcile the original attempt's status. Status polling and retry logic must be kept strictly separate, as combining them in a single function is a common source of duplicate messages. Every dispatch attempt should also check the current time against the token's expiry, halting sends once delivery would no longer be meaningful. The guiding contract is to admit each password-reset notification exactly once, retain evidence of every state transition, and never allow callers to trigger new work simply by querying the current status.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Rails Routing Explained: How URLs Map to Controllers in RESTful APIs

A developer revisited Rails routing fundamentals after realizing they could build APIs but struggled to explain the underlying mechanics. Rails uses a routes.rb file to connect incoming HTTP requests to specific controller actions, with the 'resources' helper auto-generating standard CRUD routes. Key distinctions include 'resource' versus 'resources', and the 'member' versus 'collection' blocks for non-standard actions on single or multiple records respectively. Nested resources help express relationships between models in URLs, though deep nesting is discouraged for maintainability. Namespacing, such as '/api/v1/', keeps API controllers logically separated from regular web controllers within the application.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Photo Essay Captures Isolated Workers Living at the Edge of Patagonia

A New Yorker photo essay documents the lives of men who live and work in the remote reaches of Patagonia, one of the world's most isolated regions. The piece explores themes of solitude and the unique human experience of inhabiting such an extreme environment. Published in the magazine's culture and photo section, the essay uses imagery to convey the emotional and physical isolation of these workers. The feature has drawn attention on Hacker News, sparking discussion about life at the margins of the inhabited world.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How to Integrate Claude or GPT into a Python App: A Developer Guide

A technical guide published on DEV Community explains how to integrate large language models (LLMs) such as Anthropic's Claude, OpenAI's GPT, and Google's Gemini into Python applications. All three providers offer official Python SDKs and HTTP APIs that follow a similar pattern: sending a list of messages and receiving a generated response. The guide covers key implementation topics including streaming output token by token, requesting structured JSON responses to avoid parsing errors, and managing API costs through token limits and prompt caching. Developers are advised to store API keys in environment variables rather than hardcoding them, and to handle errors using typed exceptions since official SDKs automatically retry rate-limit and server errors. The article recommends choosing model size based on task complexity, using larger models for reasoning and smaller ones for high-volume classification.

0 comments Read more at DEV Community