Amount about braintree_express_example

[immanuelfodor]

Hi @crookedneighbor, following your suggestion, what's stopping the client from rewriting the product list to get an invalid price for the cart? A simple delete could mean hundreds of $$$ by leaving out a/some products or replacing to something cheap:

// req.body.items === 'abc123,abc456,abc789';
// req.body.items === 'abc123,abc456';
// req.body.items === 'cde123';

[immanuelfodor]

I think I've got the aha moment thanks to your comment 😀
Somehow I believed the example code is a service (a payment gateway) to where the webshop submits the customer's cart, but no, the example code is the webshop itself. So if the req.body.items is the cart, then if the cart is modified, then the user will pay for the modified cart and will have the modified cart items on the receipt. In my misbelief, the customer could modify the submitted value to the gateway separately from the real cart, and this is why I had this question. Thanks for the clarification!

[crookedneighbor]

If you have an item you are selling that is worth $100, you wouldn't want to send the amount from the client, because there is nothing stopping someone from adjusting that amount from $100 to $1.

Instead, you could send ids that correspond to items and calculate the price on your server.

In this simplified example, we send the item ids as a string with commas separating each id. Doesn't really matter how you do it as long as you have the ids of the products your customer wants to purchase.

// req.body.items === 'abc123,abc456,abc789';
var items = req.body.items.split(','); // ['abc123', 'abc456', 'abc789'];

We can then look up the prices for each item on the server. You might have a database where you've stored this information, or just have it hard coded on your server. For simplicity, the example below has it hard coded.

// defined as a constant some where
var products = {
  abc123: {
    name: 'Item A',
    amount: '10.43'
  },
  abc456: {
    name: 'Item B',
    amount: '123.00'
  },
  abc789: {
    name: 'Item C',
    amount: '5.00'
  },
};

// in your transaction route
var amount = 0;

items.forEach(function (item) {
  amount = amount + products[item].amount
});

// perform transaction with amount generated on the server

[Epreuve]

@immanuelfodor I'm not sure I understand what the concern here is. In the example, the list of IDs is what the customer is purchasing. The cost is calculated on the server based on those IDs.

If a customer added or deleted items from the array, the amount they would be charged is also changed, and more to the point they wouldn't get any items removed from the array, or would still pay for items added to the array.