Securing Laravel Webhook Receivers: Signatures, Replay Protection and Idempotency

A developer describes a bug where a payment provider's retried webhook caused an order to be marked as paid twice, going unnoticed for weeks. The article argues that webhook endpoints, which accept unauthenticated POST requests that change business records, commonly share three weaknesses: they trust the caller, accept old messages, and assume each event arrives only once. It proposes answering three questions for every endpoint: whether the request is authentic, whether it is fresh, and whether it is idempotent. The walkthrough builds a Laravel receiver using HMAC-SHA256 signatures over the raw body with a timestamp, a database table with a unique index on provider and event ID, and reusable verification middleware.