Retry Storm Receipt

A mobile client times out on POST /payments and retries. The first request had actually succeeded, so users get charged twice. Which server-side design prevents the duplicate while still letting genuine repeat purchases through?

Limit clients to a single retry and treat a timeout as proof the write did not commit

Require a client-generated idempotency key and claim it atomically, replaying the stored response on retries

Hash the incoming request body and reject any byte-identical payload seen again within a short dedup window

Return 409 Conflict on any repeat charge for the same user and amount so the client knows to stop