I´ve recently implemented the PayPal JavaScript SDK in my Angular 11 project (implementation reference). It seems to work flawlessly, however, I started to think that it might be possible to modify the pricing amount on the client-side. Additionally, there seems to be no further validation on PayPal´s side if the payed amount actually matches the requested amount.
paypal.Buttons({
style: {
layout: 'vertical',
color: 'gold',
shape: 'pill',
label: 'paypal'
},
createOrder: (data, actions) => {
console.log(data);
return actions.order.create({
purchase_units: [
{
reference_id: this.id,
description: this.description,
amount: {
currency_code: 'EUR',
value: this.pricing
}
}
]
});
},
onApprove: (data, actions) => {
console.log(data);
return actions.order.capture();
},
onError: error => {
console.error(error);
},
onCancel: error => {
console.error(error);
}
}).render(this.paypalElement.nativeElement);
Therefore my research for client-side security, especially for the PayPal SDK began. In the process, I found several interesting posts on stackoverflow like:
- PayPal express checkout security with silent ajax call
- How can I secure transactions made with client-side PayPal Smart Checkout buttons?
- Secure PayPal Checkout Client-side?
- PayPal Checkout: Is it safe to receive a payment with only client-side code?
The overall consensus was pretty much: "You´re right, it´s not secure, you need to do this on the backend."
However, while I realize now that this doesn´t seem to be a secure long-term solution, none of the answers in the posts above provided some additional information on how attackers would practically modify the client-side code. I´m fairly inexperienced when it comes to modifying client-side JavaScript code, so I would really appreciate to understand the process and learn to what degree I have to secure my application.
this.pricing