Stop Trusting Notification URLs

This story was originally published on HackerNoon at: https://hackernoon.com/stop-trusting-notification-urls. If I call your impression URL twice, what happens? If the answer is anything other than “the second call is rejected,” you are paying for the second call. Check more stories related to tech-stories at: https://hackernoon.com/c/tech-stories. You can also check exclusive content about #notifications, #notification-urls, #dsp, #dmp, #url, #digital-signal-processing, #bidding, #audience-matching, and more. This story was written by: @hichem-hannafi. Learn more about this writer by checking @hichem-hannafi's about page, and for more stories, please visit hackernoon.com. Every bid response a DSP sends carries URLs that anyone who has seen the response can call: impression, click, win, billing. Most DSPs count whatever comes in, which is where discrepancy reports come from. We treated a notification URL like a cheque: valid only if we issued it, for that bid, and it hasn’t been cashed. The bidder mints hashes and a spend reservation at bid time; every callback is checked against them, duplicates and replays are rejected, and unclaimed reservations expire after 45 minutes. Result: about 6% of callbacks rejected as unverifiable, and reported impressions within 1% of the exchanges’ figures.