How to Check Whether Someone Can Just Edit the Price Your App Charges Them

Anything involving money deserves its own specific check, separate from the general access-control gaps I write about most often. One of the more common ones I still see: a checkout or upgrade flow that trusts the price or plan sent by the browser, rather than deciding it independently on the server.

How this actually gets exploited

If your checkout page sends a request that includes the price, or the plan name, as a value the browser controls, and your server simply charges whatever amount that request specifies, anyone who can inspect and edit that request, which is trivial with a browser's own developer tools, can change a premium plan's price to whatever they want before it's submitted. Your server processes exactly what it's told, because nothing on its end double-checks that number independently.

Why this is different from a normal IDOR-style gap

Most of what I write about is someone reaching data that isn't theirs. This is someone changing what they owe you, which hits your business directly rather than a specific user's privacy. It's arguably higher stakes for a founder specifically, since it's a straight line to lost revenue rather than an exposure that might never get noticed or exploited.

How to test your own checkout flow

• Start a purchase or upgrade for a real plan on your own app, using a test account.
• Open your browser's developer tools and look at the actual request being sent when you confirm the purchase.
• See whether the price, plan, or discount amount appears as an editable value in that request.
• If it does, try changing it to a lower number, then submit, and see whether your server actually charges the tampered amount.

The fix

The price and plan for any purchase need to be looked up and decided on the server, based on a plan ID or product ID the request references, never trusted directly from a value the request itself supplies. The browser can ask for plan "pro-monthly"; only your server should decide what that plan actually costs, by checking its own records, not by trusting whatever number arrived alongside the request.

Related reading

• How to Check Whether Your App Will Talk to Literally Any Website That Asks
• How to Check Whether Your "Forgot Password" Flow Is Actually Safe
• If Your App Has an Export or Download-All Button, Check Who Else Can Press It