CodePark/ questions / Business logic & race conditions
START PRACTICINGPRACTICE
Backend question · Auth & security › Business logic & race conditions

The checkout endpoint charges the total from this body, after checking that it equals the sum of the item prices in the same body. What's the problem?

POST /api/checkout
{ "items": [{ "productId": "p_42", "quantity": 1, "price": 0.01 }], "total": 0.01 }
The client also controls the prices, so it can make them match any total. The server must look up prices in its own database

The check compares two numbers that both come from the attacker. The server should accept only product ids and quantities. It should work out prices, discounts, shipping and tax from its own data, and check that quantities are positive whole numbers.

"Nothing, as long as the site uses HTTPS" is the tempting wrong answer. HTTPS protects the body on the network. But here the attacker is the client, and can send any body with DevTools or curl. Hiding fields in the UI changes nothing for the same reason.