Agent WranglersAbuse and limits Required
Work out every amount on the server
Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
How to do it
Send only product IDs and quantities from the browser, and look up prices on the server. Reject quantities below one or above a sensible cap. Track each order's state, so payment cannot be skipped. Mark a coupon as used in the same step that applies it.
Example
{ "items": [{ "product": "mug-blue", "quantity": -1, "price": 0.01 }], "coupon": "WELCOME10" }How to check
Change the price to 0.01 in the request, send a quantity of -1, and reuse a single-use coupon. Each request is rejected, and the order total is unchanged.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/server-side-business-rules.