Agent WranglersAPS-52Required
Work out every amount on the server
Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
How to do it
Send only product IDs and quantities from the browser, and look up prices on the server. Reject quantities that are not whole numbers, below one or above a cap set per product, such as 99. Track each order's state, so payment cannot be skipped. Mark a coupon as used in the same step that applies it.
Examples
JSON example
{ "items": [{ "product": "mug-blue", "quantity": -1, "price": 0.01 }], "coupon": "WELCOME10" }How to check
Change the price to 0.01 in the request, send a quantity of -1, and reuse a single-use coupon. Each request is rejected, and the order total is unchanged.
Sources
Related rules
- ECM-13 Recheck prices and stock when the order is placed in E-commerce and fulfilment
- ECM-36 Apply discounts on the server in one fixed order in E-commerce and fulfilment
- ANA-3 Record business facts on the server in Product analytics and experiments
- PRC-1 Keep prices in a versioned catalogue in Pricing, plans and entitlements
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/limits-and-business-logic/server-side-business-rules">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.