Small bug I hit in an n8n workflow:
My code pulled the email address out of "Name <email>".
It worked for that format.
But a bare address like [email protected] came out as [email protected].
Lesson: test the boring input too, not only the "normal" one.
@BoboLinNotes Exactly. The timestamp window only limits how old a request can be. The event ID store is what actually catches a replay. I keep IDs a bit longer than the window so retries still get deduped.
If a service sends you webhooks, check 3 things before you trust the request:
1. The signature (HMAC) matches your secret
2. The timestamp is recent (I use 5 minutes)
3. You haven't seen this event ID before
Many senders retry, so the same event can arrive twice.
Ran my invoice workflow twice on the same emails.
The sheet still had 2 rows, not 4.
The trick: build a row key from fields that don't change (like invoice number + sender) and skip rows that already have it.
Automations will run twice. Plan for it.