Direct answer
A valid signature can be replayed, and legitimate providers also retry events. Authenticate the event, apply the protocol's freshness controls where supported, and make processing idempotent using a durable event record.
Understand the sender's retry contract
Identify which event ID and timestamp fields are authenticated, how long retries can occur and how the sender expects acknowledgment. Do not assume every delivery header is signed: an unsigned identifier cannot independently prove freshness or origin.
Reference: OWASP Webhook Security Cheat Sheet.
Test duplicates without real side effects
Use a test event tied to a disposable order or subscription. Send the valid event twice, including a realistic retry, and verify that the business action happens once. Inspect the processing record as well as HTTP responses; a repeated successful acknowledgment can be correct if the event was already processed.
- Use fixtures that cannot charge customers or send external notifications.
- Record event ID, processing outcome and test times without storing the shared secret.
- Exercise concurrent duplicate deliveries as well as sequential retries.
Test freshness where the protocol permits it
If the sender authenticates its timestamp, test a correctly signed stale delivery against the configured tolerance and verify rejection. Check clock synchronization and follow the provider's signing format. A timestamp that is not covered by authentication must not be trusted as a replay control.
Check persistence and failure recovery
Simulate an agreed processing failure after receipt and verify that retry does not lose the event or repeat an already committed side effect. Define whether an event is durably queued before acknowledging it, and review retention and expiration of deduplication records.
Assessment limits
Exactly-once behavior across distributed systems requires careful design and cannot be established by two simple requests. Freshness support and retry identity differ by provider and must be assessed against the actual protocol.
Frequently asked questions
Should every duplicate return an error?
Not necessarily. A valid event already durably processed may be acknowledged successfully to stop retries, while the protected action remains idempotent.
Does a signature prevent a captured request being replayed?
No. A replay can retain a valid signature. Combine the protocol's authenticated freshness mechanisms with durable duplicate handling.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.