0

I'm using a third party CRM application which allows you to build web forms using drag and drop widgets and the ability to add javascript code to manipulate those widgets.

I need to build a form to take payments using another third party payment gateway.

The basic process is as follows:

  • customer selects products on the form.
  • I use inline javascript to work out the total cost.
  • customer submits form which generates a case ref number
  • upon the submit event i use javascript to create a payment basket using the payment gate way api and upon successful creation I redirect user to the payment gateway to make payment.

My question is when i create the payment basket using the payment gateway api, i send the json payload including the total to pay using javascript. e.g.

var total = 100;
var ref = 123456;

$.ajax({
  url: 'paymentgatewaycreatebasketurl',
  dataType: 'json',
  type: 'post',
  contentType: 'application/json',
  data: JSON.stringify( { "Ref": ref, "PaymentAmount": total, "Quantity": 1, ... } ),
  processData: false,
  success: function( data, textStatus, jQxhr ){
    // redirect user to paymentgateway payment page using returned token and basket ref.
  },
  error: function( jqXhr, textStatus, errorThrown ){
    console.log( errorThrown );
  }
 });

Is it possible for a malicious user to edit the javascript and change the total amount e.g. using chrome dev tools etc?

What are the implications of doing it this way and is there a more secure method to prevent users from editing the total to pay?

I'm unable to define the total on the server side due to limitations of the CRM product hence having to do it using javascript.

1 Answer 1

6

Is it possible for a malicious user to edit the javascript and change the total amount e.g. using chrome dev tools etc?

Absolutely - or just write their own client to post to your API.

What are the implications of doing it this way

Your business will fail miserably when you send out all your products for zero cost.

is there a more secure method to prevent users from editing the total to pay?

Not if you do it on the client.

I'm unable to define the total on the server side due to limitations of the CRM product

Your "CRM product" is not fit for purpose - get a new one (or perhaps more likely, you are not understanding how to use your CRM).

4
  • how would you edit the javascript, I've been unable to edit the javascript in chrome dev tools as it's written inline i.e. not in a external file?
    – adam78
    Dec 7, 2021 at 11:45
  • 4
    @adam78 the fact that you don't know how to do it is not a guarantee that highly motivated people with more experience can't do it. Not surprisingly, if money is involved, bad guys can be quite motivated. Dec 7, 2021 at 12:02
  • 6
    Also, the fact that you can't do it in Chrome dev tools doesn't mean that I can't do it in the tool of my choice, which I have complete freedom to choose because I'm in control of the client. You must validate on the server side, don't even try and work around it. Dec 7, 2021 at 12:10
  • Agree. Its a hard NO to the question of "is my JS good enough for security without server validation?". Having said that, its up to your business how you proceed. Is there a spot in your process where a human checks the order as its being filled? Is your client base something like businesses which would not want to risk a fraud charge if they try to 'scam' you this way? If either of those things are the case for you, then maybe you are fine proceeding temporarily with this solution, but I'd make plans to establish a proper payment architecture ASAP even in that case.
    – GHP
    Dec 8, 2021 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.