ECM-13Recommended
Recheck prices and stock when the order is placed
When the buyer places the order, recompute every price, discount, shipping cost and tax on the server and check stock again. If the total differs from what the buyer saw, show the new total and ask again before charging.
How to do it
A cart can sit for days while prices, stock and coupons change. Never charge a total the buyer did not see, and never honour a stale lower price by accident. Keep only variant IDs, quantities and codes in the cart, and compute amounts from the catalogue, as Work out every amount on the server requires. Send the total the buyer saw with the order request, and refuse it when it differs from the fresh total. Once the order exists, freeze its lines as Freeze what the customer agreed to on the order says.
Examples
TypeScript example
export async function placeOrder(cart: Cart, shownTotalMinor: number) {
const quote = await priceCart(cart); // catalogue prices, discounts, shipping, tax
if (quote.totalMinor !== shownTotalMinor) return { status: 'total_changed', quote };
return { status: 'ok', order: await createOrder(cart, quote) };
}
Python example
def place_order(cart, shown_total_minor: int) -> dict:
quote = price_cart(cart)
if quote.total_minor != shown_total_minor:
return {"status": "total_changed", "quote": quote}
return {"status": "ok", "order": create_order(cart, quote)}
How to check
A test raises a price after the cart was shown and then places the order. No payment is created, and the answer carries the new total. A second request with the new total succeeds.
Related rules
- SEC-59 Work out every amount on the server in Adversarial testing
- PAY-12 Freeze what the customer agreed to on the order in Payments and billing
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ecommerce/carts-and-checkout/recheck-at-checkout">Agent Wranglers e-commerce and fulfilment playbook</a>. In code you write, add a comment next to it with the same link.