Context#
Two callbacks reference the same business key but arrive on different connections. If the handler applies “last write wins” without a monotonic state version, capture may be processed before authorize, or a refund before a charge settles, leaving accounts inconsistent.
Theory#
Compare with distributed-systems version vectors; many CRUD apps omit them on webhook handlers.
Practice#
- In staging, delay one callback artificially (slow proxy) and send the dependent event first; observe ledger or entitlement tables.
Tools#
- Burp Suite with Throttling
- tc / netem in a lab network
References#
- PortSwigger Web Security Academy: Race conditions
- OWASP WSTG: Testing for Business Logic