How would you even know the second request is different? Hash every request? That's a waste of resources. The only sensible policy is to trust the key.
No, the sensible policy is to have the code operate idempotently for every request with an idempotent method. This is a design decision, not something you slap on top afterward with a special key.
