Great suggestion. This way people can use their existing server-side payment integration if they need to, manage stock levels, sanity-check the customer address

Great suggestion. This way people can use their existing server-side payment integration if they need to, manage stock levels, sanity-check the customer address, run fraud-checks or whatever they need to do before the order is processed and payment is taken. It should virtually eliminate the js security flaw. Or at least give the chance to eliminate it. It makes implementing a cart on a website much simpler because you reduce the interface points between the client and the server to one (at least as far as the actual cart needs to keep itself updated).