Webhook Replay Attacks Can Grant Duplicate Entitlements Without Idempotency Checks

A single valid webhook event delivered multiple times can trigger duplicate entitlement grants if handlers rely solely on signature verification without idempotency controls. Signature verification confirms a payload is authentic but does not determine whether it has already been processed, meaning five replays of the same signed webhook can produce five separate access grants. A teaching example called ShipTested demonstrates this vulnerability by replaying one signed order webhook five times, resulting in five entitlements instead of one. The fix introduces a stable event key derived from the event name, order type, and order ID, ensuring subsequent deliveries of the same event are treated as no-ops. Developers are cautioned that the in-memory demonstration is not production-safe, as atomic database operations and multi-instance coordination are required for real-world deployments.