The order is marked paid.
The payment provider says
it never told you that.
Your endpoint is a public URL.
It has to be.
The entire point of a callback
is that somebody out on the internet
can reach it without logging in.
So what arrived is not news from your provider.
It is a request from whoever sent it,
claiming to be news from your provider,
and you believed it
because it was well formed
and it came to the right address.
The signature was in the headers.
You did not check it.
Or you checked it
against the parsed body
rather than the raw bytes,
which stops being a check
the moment a framework
reorders a key or trims a space.
Verify against exactly what arrived,
before anything touches it.
Then keep going,
because a valid signature
is not a fresh message.
A genuine one, captured once,
stays valid forever
unless you decide otherwise.
Take the timestamp inside the payload.
Refuse anything older than a few minutes.
Record the event id
and refuse the same one twice.
You need that anyway.
Providers retry.
They will send you the same event
three times on a bad afternoon,
and if your handler adds stock,
or sends an email,
or credits an account,
you will do it three times
and spend a week calling it a mystery.
Then the last habit,
the one that costs a round trip
and saves everything else.
The message tells you
that something may have happened.
It does not tell you what is true.
Take the identifier,
call the provider yourself,
and ask what the state is now.
That answer is authoritative.
The callback was only a nudge
suggesting it was worth asking.
Treat every one of them
as a note pushed under your door
saying it is from your bank.
Check the handwriting.
Check the date.
Make sure you have not
already acted on this one.
Then go and ask the bank.
– Serguey Asael Shinder
