How can I prevent users from overriding the total price in the shopping cart when sending as a hidden input field?

Question

I am having serious problems accepting payments.

I pass the total in a hidden field

<input type="hidden" name="checkout-flow-support.merchant-checkout-flow-support.shipping-methods.flat-rate-shipping-1.price" value="129.00"/> 

Some users changed this value to 2 using firebug and submitted a form. Instead of getting $ 129, we got only $ 2.

I have no idea how to do this so that someone quickly helps me.

Answer 1

im passes the total amount in a hidden field

Do not do this!

Since you know what items the user is trying to acquire, calculate the cost server side.

Answer 2

This is a mistake in a textbook, similar to asking a client in a brick and mortar store how much this item costs and he trusts this answer. This is a special case of the general security principle: do not trust the client. The answer to Hobodave is correct; calculate prices, taxes, etc. server side.

Answer 3

With payment service providers (PSPs), the general communication setup usually looks something like this:

1) Your server contacts the PSP and establishes the transaction, indicating the required amount and details of your PSP account.

2) PSP responds with a transaction identifier, which you then add to the form. This transaction identifier does not contain pricing information - it is simply the transaction record identifier configured by your server using PSP.

3) The visitor fills out a form, which is sent to the PSP. Then they redirect the visitor to your site.

4) The server requests the PSP server and verifies that the transaction was successful (i.e., the OK visitor payment method completed the transaction with the PSP, etc.)

Communication between the server and the PSP is usually done using a library such as curl.

Google provides several libraries / examples of how to handle transactions correctly (and most other PSPs do the same, in my experience): http://code.google.com/apis/checkout/samplecode.html

The exact information about the connection may vary depending on the PSP, but in principle it should not be necessary for the “total amount” to pass through the form displayed to the visitor. All this is done from server to server so that the visitor cannot change the details.