This lesson's interactive features are locked, please to keep using them

Don't Trust the Client

The browser belongs to the user. Anything it sends to your server can be inspected, changed, omitted, or downright fabricated.

That includes values your own HTML generated! A hidden input is absent from the visible page, but it still appears in the document and any submitted requests:

<input name="discountCents" type="hidden" value="0" />

An attacker can change 0 to 4497 before submitting the form or send a hand-crafted request without using the form at all. Hidden means not displayed; it does not mean trusted.

Nightmare Scenario

Client input becomes dangerous when the server uses it to make a security-sensitive decision. Imagine a checkout handler that lets the browser choose the discount and price values applied to an order. Just by using curl, an attacker can make a $44.98 cart cost just 1 cent!

The server should load product prices and valid discounts from trusted server-side data, then calculate the total itself. The client can identify products or a promo code, but the server needs to resolve those IDs to trusted values.

Assignment

Bearly Secure trusts a hidden discountCents field when creating an order. Calculate order totals entirely from server-side cart data.

Reset the database and start the app.
Log in as Mabel and add one "Classic Teddy" and one "SQLi Sloth" to the cart.
Go to checkout, then use your browser's developer tools to inspect and change the hidden discountCents HTML input's value from 0 to 4497. Place the order and confirm the $44.98 cart is recorded as a $0.01 order.
Remove the client-controlled discount:
1. In the POST /checkout handler in src/routes/checkout.ts, stop reading discountCents from the request body and stop passing it to createOrderFromCart.
2. In src/orders/index.ts, remove the discountCents parameter from createOrderFromCart.
3. In renderCheckoutPage in src/views/checkout.ts, delete the hidden discountCents input from the checkout form.

With Bearly Secure still running, run and submit the CLI tests from the project root.