3 ms·

I can modify the price in the checkout by changing the URL parameter. Really?

veb 9y ago
Can also use a negative price! I wonder what would happen if you went ahead with that. Presumably the payment gateway wouldn't pay me $5. Seems a strange choice to be having those parameters in a GET.
- throwaway1909 9y ago
  Why stop at $5? Try setting quantity or price to -9e999999999. How will you spend your $∞ dollars?
  - mlvljr 9y ago
    On the most stellar lawyer there is?
- paulie_a 9y ago
  > Presumably the payment gateway wouldn't pay me $5 Having dealt with payment gateways, I would not assume that.
- badsectorlabs 9y ago
  I agree, the param passing is not ideal. Session storage/local storage is another option.
  - stdclass 9y ago
    Everything that can be modified by the user is not suitable. The price must be stored on the server side, everything on the client side is subject to modification.
    - badsectorlabs 9y ago
      The price is checked server side. You have to pass the price somehow to the client in order to display it. This is no different than any other ecommerce site, except that you can see it in a GET param. I can "change the price" of anything on Amazon with dev tools, but that won't help me when I go to buy it. I appreciate the concern because amazingly this has been a real vulnerability on sites before (recently on a crypto exchange I think).
    - gdamjan1 9y ago
      Storing it, or passing it by the user can be suitable if the data is signed
  - NicoJuicy 9y ago
    Temporary guid on client side, data on server side
  - marcc 9y ago
    This is just obfuscation. Making it harder to hack won't prevent hacks. Anything that can be changed by the client, expect the client to change it.
auganov 9y ago
Once upon a time, my fav food ordering place had the discount encoded in the URL. Couldn't stop myself from trying, reduced the price by a very small number and it actually worked irl!
badsectorlabs 9y ago
Yes, or you could edit the html source with dev tools. Trying to purchase a ticket with a modified price will not work. Never trust user input!
gowld 9y ago
Sure you can overpay if you want, and you can underpay and not get the tickets you are trying to obtain fraudulently. It's only a problem if the vendor actual sends you product that you didn't pay for. This isn't an instant digital download.
- badsectorlabs 9y ago
  It is checked server-side. I understand why people are concerned that the price is passed in a way that they can see vs grabbed via javascript or another method like most other sites, but that doesn't change the responsibility to check the data server-side. I can edit my POST requests to Amazon but they better not sell me stuff for $0, and neither will this site.

veb 9y ago

Can also use a negative price! I wonder what would happen if you went ahead with that. Presumably the payment gateway wouldn't pay me $5. Seems a strange choice to be having those parameters in a GET.

throwaway1909 9y ago
Why stop at $5? Try setting quantity or price to -9e999999999. How will you spend your $∞ dollars?
- mlvljr 9y ago
  On the most stellar lawyer there is?
paulie_a 9y ago
> Presumably the payment gateway wouldn't pay me $5 Having dealt with payment gateways, I would not assume that.
badsectorlabs 9y ago
I agree, the param passing is not ideal. Session storage/local storage is another option.
- stdclass 9y ago
  Everything that can be modified by the user is not suitable. The price must be stored on the server side, everything on the client side is subject to modification.
  - badsectorlabs 9y ago
    The price is checked server side. You have to pass the price somehow to the client in order to display it. This is no different than any other ecommerce site, except that you can see it in a GET param. I can "change the price" of anything on Amazon with dev tools, but that won't help me when I go to buy it. I appreciate the concern because amazingly this has been a real vulnerability on sites before (recently on a crypto exchange I think).
  - gdamjan1 9y ago
    Storing it, or passing it by the user can be suitable if the data is signed
- NicoJuicy 9y ago
  Temporary guid on client side, data on server side
- marcc 9y ago
  This is just obfuscation. Making it harder to hack won't prevent hacks. Anything that can be changed by the client, expect the client to change it.

auganov 9y ago

Once upon a time, my fav food ordering place had the discount encoded in the URL. Couldn't stop myself from trying, reduced the price by a very small number and it actually worked irl!

badsectorlabs 9y ago

Yes, or you could edit the html source with dev tools. Trying to purchase a ticket with a modified price will not work. Never trust user input!

gowld 9y ago

Sure you can overpay if you want, and you can underpay and not get the tickets you are trying to obtain fraudulently. It's only a problem if the vendor actual sends you product that you didn't pay for. This isn't an instant digital download.

badsectorlabs 9y ago
It is checked server-side. I understand why people are concerned that the price is passed in a way that they can see vs grabbed via javascript or another method like most other sites, but that doesn't change the responsibility to check the data server-side. I can edit my POST requests to Amazon but they better not sell me stuff for $0, and neither will this site.