Checkout form submits a hidden price field
ShipReady found a hidden amount-like input submitted to an endpoint that looks like a checkout flow.
Why it matters
Hidden inputs are visible and editable to the person using the browser. A checkout should calculate the final amount from trusted server-side data.
How ShipReady detects it
What it inspects
ShipReady examines server-delivered HTML forms for hidden amount-like inputs and resolves their actions. It limits this check to known payment providers or checkout-looking destinations.
What triggers a finding
The rule triggers when a hidden money field is submitted by a qualifying checkout form.
What the evidence shows
A hidden amount-like value is present in the observed checkout form submission.
Limits of this check
ShipReady does not submit the form or inspect the server that receives it. For an application endpoint, it cannot prove that a changed field alters a charge; the server may reprice the purchase correctly. It also does not assess all dynamically created forms.
How to fix it
Submit an identifier, not the authoritative price
Use a product, price, or cart identifier and calculate the amount on the server from trusted records.
Review direct provider submissions
For a form that posts directly to a payment provider, ensure the provider-side amount is created from a trusted server workflow.
How to verify the change
Test the server-side price decision
In a controlled test environment, alter the hidden field and confirm the server or provider workflow rejects it or charges the authoritative amount.
Expected: A browser edit cannot reduce the amount charged or change the purchased entitlement.