Checkout request includes a browser-supplied amount
ShipReady found a client-side request to a checkout-looking endpoint whose body includes an amount-like field.
Why it matters
A browser is under the visitor's control, so a server should derive a charge from trusted product or price data instead of trusting an amount supplied by the client.
How ShipReady detects it
What it inspects
ShipReady reads the page HTML and successfully fetched script text. It looks for a request URL that resembles a checkout endpoint and a nearby request body containing an amount-like field.
What triggers a finding
The rule triggers when those request, checkout-path, request-body, and money-field signals occur together.
What the evidence shows
The observed client code sends an amount-like value to a checkout-looking endpoint.
Limits of this check
ShipReady does not call the endpoint, inspect backend code, alter a request, or charge a payment method. It cannot determine whether the server ignores the submitted amount and calculates the price from trusted data.
How to fix it
Derive the charge on the server
Send a product, price, or cart identifier from the browser and look up the amount in server-side trusted data before creating a payment.
Treat client values as untrusted
If an amount is accepted for a legitimate use case, validate authorization, currency, bounds, and the server-side business rule before using it.
How to verify the change
Trace the checkout endpoint
Follow the request from the browser to the server and confirm the server obtains the authoritative price rather than using the request amount.
Expected: Changing the browser-supplied amount cannot change the amount charged or entitlement granted.