Comment by Someone1234 | Hacker News Reader

Comment by Someone1234 | Hacker News Reader

Parent Full thread

They offer Idempotent Requests[0][1] to prevent exactly this. While I think it is a shame you're in this position, I am surprised anyone would perform card transactions without a debounce of any kind (even disabling the UI element until the previous request completes/fails).

As to if Stripe should "allow" this; while I think $8,200 is too much for repeat transactions, I don't think repeat identical transactions is that odd in general. Even within a couple of seconds (e.g. 99 cent in-app-purchases). The only thing that surprises me is that there is no upper limit/sanity check.

You could ask them to waive some of the fee, but some of it might be their costs.

[0] https://stripe.com/blog/idempotency

[1] https://stripe.com/docs/api/idempotent_requests

At a brief glance it seems they ensure idempotency w.r.t. possible errors/network failures etc. not necessarily to multiple purchases done by the customer by mistake.

In that case I think some high velocity fraud filters should kick in (which they probably did). Indeed the purchase amount is very large, so you wouldn't really expect it to be a repeated high velocity buy. On the other hand Stripe can't really cover all possible edge cases all of the time.

You render a UUID into the browser form and send it along with the submission however you want (post input, http header, etc). Then the server both requires the UUID to be there and passes it along to stripe.

Stripe will not allow an idempotent key to be reused w/i 24 hours.

You can use anything for the idempotent key and Stripe will actually track that along with the charge object so you can use something more meaningful if it's useful for your business.

edit: and if you generate a key that's more meaningful I'd be careful about leaking important/private data.

Yeah, but that should only prevent duplicates due to technical errors, but not duplicates because the person actually made a number of distinct purchases my mistake.

Take a look also at edwinwee's answer below.

What you just said is 100% incorrect and I strongly recommend you read back over what I wrote and think about it a bit more.

Reply on news.ycombinator.com