Pricing must happen server-side

The most expensive bug

If your checkout accepts { productId, price } and writes it straight to the database, an attacker only needs to edit one request body to buy anything for ¥0.01.

The right shape

The client sends only "product + variant + quantity + form"; the server takes that input, re-looks-up the price from the catalog, re-applies member discounts, re-computes the promo code, then creates the order.

Applies equally to

• Stock: the server re-validates quantity; don't trust the client's purchase limits.
• Forms: the account-subject format must be re-validated server-side.
• Payment status: an order is paid only after the payment channel's callback passes signature verification.