Sreerag Pramod

Excessive Trust in Client-Side Controls

A walkthrough of how trusting client-sent price data instead of validating it server-side let me buy a $1337 item for a single cent, and what it teaches about business logic security. Introduction A