Tax/fee calculations pre-filled with server verification

Any fee or tax value that the server accepts directly from the client request body is tamper-able: a user reduces fee to 0 before submitting and pays less. This is OWASP A03 (Injection) and CWE-602 (Client-Side Enforcement of Server-Side Security) in one pattern. PCI DSS Req-6.2.4 requires server-side validation of all payment parameters. The client can display a fee preview for UX purposes — but the server must independently compute and verify the fee amount before it reaches the ledger.

Never read fee or tax from the request body. Compute them server-side from the canonical inputs and compare against any client-submitted value if you want to surface mismatches.

// src/app/api/checkout/route.ts
export async function POST(req: Request) {
  const { amountCents } = await req.json(); // only accept the base amount

  // Calculate server-side
  const feeCents = Math.round(amountCents * 0.02); // 2% platform fee
  const taxCents = Math.round(amountCents * 0.08); // 8% tax
  const totalCents = amountCents + feeCents + taxCents;

  // Commit with server-calculated values only
  await db.order.create({ data: { amountCents, feeCents, taxCents, totalCents } });
}