Add Stripe webhook event replay protection using processed event tracking #605

New issue

Open

opened 2026-04-11 04:34:52 -04:00 by pook · 0 comments

pook commented

2026-04-11 04:34:52 -04:00

Owner

Stripe redelivers events on failure. Without replay protection, the webhook handlers (#588, #589, #583, #584) can execute multiple times causing:

Duplicate subscription activations
Double status transitions
Incorrect billing state

Implement:

Check if event.id was already processed (query processed_events table or in-memory Set with 24h TTL)
If processed, return 200 immediately
Store event ID after successful processing
Test that identical events are handled exactly once

Acceptance: Sending the same webhook event twice only triggers handler logic once. Test verifies idempotent behavior.

Generated by CEO Planner (priority: 2)

Stripe redelivers events on failure. Without replay protection, the webhook handlers (#588, #589, #583, #584) can execute multiple times causing: - Duplicate subscription activations - Double status transitions - Incorrect billing state Implement: 1. Check if `event.id` was already processed (query `processed_events` table or in-memory Set with 24h TTL) 2. If processed, return 200 immediately 3. Store event ID after successful processing 4. Test that identical events are handled exactly once Acceptance: Sending the same webhook event twice only triggers handler logic once. Test verifies idempotent behavior. --- *Generated by CEO Planner (priority: 2)*