Hacker News new | ask | show | jobs
by stdclass 3034 days ago
Everything that can be modified by the user is not suitable. The price must be stored on the server side, everything on the client side is subject to modification.
2 comments

The price is checked server side. You have to pass the price somehow to the client in order to display it. This is no different than any other ecommerce site, except that you can see it in a GET param.

I can "change the price" of anything on Amazon with dev tools, but that won't help me when I go to buy it. I appreciate the concern because amazingly this has been a real vulnerability on sites before (recently on a crypto exchange I think).

Storing it, or passing it by the user can be suitable if the data is signed