Currency conversions server-side, locked at transaction time

A client-side exchange rate is fetched at page load and may be stale seconds later. More critically, it can be tampered: any user with browser devtools can edit the rate in memory before submitting, receiving a conversion at an artificially favorable rate. OWASP A03 (Injection) and CWE-602 (Client-Side Enforcement of Server-Side Security) both flag trusting client-calculated financial values. PCI DSS Req-6.2.4 requires server-side validation of all input data used in financial operations.

Move all currency conversion logic into the server route and persist the locked rate with the transaction record. Never accept a converted amount or exchange rate from the client request body.

// src/app/api/transfers/route.ts
export async function POST(req: Request) {
  const { fromAmountCents, fromCurrency, toCurrency } = await req.json();

  // Fetch and lock the rate server-side
  const rate = await getExchangeRate(fromCurrency, toCurrency);
  const toAmountCents = Math.round(fromAmountCents * rate);

  await db.transaction.create({
    data: { fromAmountCents, toAmountCents, exchangeRate: rate, lockedAt: new Date() },
  });
}