How to Block Webhook Replay Attacks Using Node.js and PostgreSQL

Webhook replay attacks occur when a valid, signed payload is resent to a server, potentially allowing actions like duplicate balance credits to execute more than once. A multi-layer defense in Node.js and PostgreSQL can prevent this by combining timestamp freshness checks, HMAC signature validation, and database-level idempotency. Storing processed event IDs in PostgreSQL with a unique constraint ensures duplicates are rejected even under concurrent requests, unlike Redis which can lose state on cache flush or container restart. The approach uses a middleware function that rejects requests older than five minutes, verifies signatures using constant-time comparison to prevent timing attacks, and queries the database for duplicate event IDs. This setup guarantees each webhook payload is processed exactly once, providing reliable protection for payment and other sensitive event pipelines.