---
title: "Work out every amount on the server · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/server-side-business-rules
updated: 2026-10-20
licence: "All rights reserved"
---

# Work out every amount on the server

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)
- Rule: Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
- How: Send only product IDs and quantities from the browser, and look up prices on the server. Reject quantities that are not whole numbers, below one or above a cap set per product, such as 99. Track each order's state, so payment cannot be skipped. Mark a coupon as used in the same step that applies it.
- Check: Change the price to 0.01 in the request, send a quantity of -1, and reuse a single-use coupon. Each request is rejected, and the order total is unchanged.

Example:

```json
{ "items": [{ "product": "mug-blue", "quantity": -1, "price": 0.01 }], "coupon": "WELCOME10" }
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/server-side-business-rules`.

- Previous: [Give the same answer for known and unknown accounts](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/no-account-enumeration)
- Next: [Make each change happen exactly once](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits/race-conditions)
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits)