Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is a plain `POST /orders` endpoint, by HTTP convention, NOT naturally idempotent?
💻 Code Challenge | +75 XP
Implement idempotency key handling for a POST /orders endpoint using Redis, storing the result keyed by the idempotency header, with a distributed lock preventing a race between two near-simultaneous requests bearing the same key.
A client retrying a timed-out order-creation request accidentally created two separate orders for the customer, since the endpoint had no idempotency protection. Reorder the steps to fix this properly.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant

Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Assuming a POST endpoint is safe to retry automatically without any idempotency protection
// Wrong: no protection, a retry can create a duplicate
app.post("/orders", async (req, res) => { const order = await createOrder(req.body); res.json(order); });
// Correct: idempotency key prevents a retry from duplicating
const key = req.headers["idempotency-key"];
// check Redis for an existing result under this key firstThe Solution //
POST is not naturally idempotent — a client automatically retrying a POST request after a network timeout, unaware of whether the original request actually succeeded, risks creating a duplicate resource (a duplicate order, a duplicate charge) if the original request had in fact already succeeded.
The Error //
Storing an idempotency key's result without also binding it to the exact original request body
// Wrong: doesn't detect a mismatched reuse
const cached = await redis.get(`idempotency:${key}`);
if (cached) return res.json(JSON.parse(cached));
// Correct: detects and flags a mismatch
if (cached.requestHash !== hashRequest(req.body)) return res.status(422).json({ error: "Key reused with different data" });The Solution //
Without verifying the request body matches, a client accidentally reusing an idempotency key with genuinely different data would silently receive the original, now-mismatched result instead of a clear error — masking what is likely a client-side bug.