4 ms·

So, as a web developer, I'm not seeing anything that would inspire confidence regarding someone simply inspecting & changing this data attribute to: data-item-

So, as a web developer, I'm not seeing anything that would inspire confidence regarding someone simply inspecting & changing this data attribute to: data-item-price="0.01" I skimmed through the documentation, but didn't see any real mention of this concern. I think it should be highlighted. Seems that by allowing it to be in markup it might encourage people to be negligent and perhaps miss verifying that the submitted price is correct... maybe I'm missing something here.

wodow 13y ago
Presumably they crawl the website on signup and watch out for major changes in price like that? But, yes, if that's the case then that should be highlighted in the docs.
- charles_ouellet 13y ago
  We crawl the page that you specify within the data-item-url attribute. We validate that no product informations has been altered. If so, we simply ignore the order and nothing is charged or processed.
  - greenpizza13 13y ago
    Who specifies the page? Is that set up in the SnipCart admin?
  - tyleregeto 13y ago
    What happens when products are loaded with JS after the initial load? For example, maybe the user presses a "Load More" button, or the site uses infinite scrolling, etc. Do you guys handle that in any way? I'm not trying to trash your product, I'm just genuinely curious.
    - charles_ouellet 13y ago
      The markup must be available on the webpage when it loads, but we plan to have JSON endpoints in a very near future, so if the URL that we crawl returns json, we will use it instead of crawling the HTML. It will be documented soon.
  - arcameron 13y ago
    How does the crawling occur? What if I altered the data-item-url attribute?
    - charles_ouellet 13y ago
      Just before the order payment is being done, we crawl the URL of the product, we check for a product with the specified ID and validate that the price, name, any other properties have not been altered. If it has been altered, we reject the order. The URL in data-item-url must be on your site domain, so by example, if you change the data-item-url from snipcart.com/product to myapp.com/product, it will be considered as altered and the order will be rejected.
alcari 13y ago
What really scares me is that there's no mention of security on their site aside from the usual "we use HTTPS" line.
- charles_ouellet 13y ago
  We will add more informations about how our price validation works very soon. Also, we already suggest our customers to make sure their website is HTTPS also.

wodow 13y ago

Presumably they crawl the website on signup and watch out for major changes in price like that? But, yes, if that's the case then that should be highlighted in the docs.

charles_ouellet 13y ago
We crawl the page that you specify within the data-item-url attribute. We validate that no product informations has been altered. If so, we simply ignore the order and nothing is charged or processed.
- greenpizza13 13y ago
  Who specifies the page? Is that set up in the SnipCart admin?
- tyleregeto 13y ago
  What happens when products are loaded with JS after the initial load? For example, maybe the user presses a "Load More" button, or the site uses infinite scrolling, etc. Do you guys handle that in any way? I'm not trying to trash your product, I'm just genuinely curious.
  - charles_ouellet 13y ago
    The markup must be available on the webpage when it loads, but we plan to have JSON endpoints in a very near future, so if the URL that we crawl returns json, we will use it instead of crawling the HTML. It will be documented soon.
- arcameron 13y ago
  How does the crawling occur? What if I altered the data-item-url attribute?
  - charles_ouellet 13y ago
    Just before the order payment is being done, we crawl the URL of the product, we check for a product with the specified ID and validate that the price, name, any other properties have not been altered. If it has been altered, we reject the order. The URL in data-item-url must be on your site domain, so by example, if you change the data-item-url from snipcart.com/product to myapp.com/product, it will be considered as altered and the order will be rejected.

alcari 13y ago

What really scares me is that there's no mention of security on their site aside from the usual "we use HTTPS" line.

charles_ouellet 13y ago
We will add more informations about how our price validation works very soon. Also, we already suggest our customers to make sure their website is HTTPS also.