Never trust the client with your Stripe price

The article discusses a critical security issue in Stripe API integrations where client-side requests can influence monetary values or other sensitive information without proper validation on the server side. This is particularly dangerous because attackers could manipulate these values to exploit vulnerabilities such as paying less for services or accessing unauthorized features.

Key Points:

1. Server Ownership of Money-Shaped Values:

   • The core principle is that any value related to money (prices, quantities, coupons) must be controlled and validated by the server-side logic.
   • Client requests should only contain identifiers like plan names or coupon codes which are then mapped to secure, server-controlled values.

2. Common Vulnerabilities:

   • Price Manipulation: If a client can send priceId or amount, an attacker could tamper with these fields to pay less.
   • Quantity Tampering: Negative quantities were known to cause issues in older Stripe versions.
   • Coupon Codes: Client-provided coupon codes should be validated by the server to ensure they are legitimate and applicable.

3. Verification Steps:

   • Open your pricing page and observe the network requests when subscribing or purchasing a plan.
   • Replay these requests with tampered data (e.g., incorrect

Read the full article at DEV Community

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.