Calculated totals recalculated server-side

A client-submitted grandTotal that the server uses directly is tamper-able: subtract $5 from the total before submitting and pay less. CWE-602 and OWASP A03 both flag trusting client-calculated aggregates. PCI DSS Req-6.2.4 requires independent server-side validation of all payment amounts. This pattern is particularly risky because the individual components (subtotal, tax, fee) may each be validated correctly while the tampered total bypasses all of them.

Ignore any total field from the client and reconstruct it server-side from validated components before committing.

// src/app/api/checkout/route.ts
export async function POST(req: Request) {
  const { subtotalCents, taxRateBps, feesCents } = schema.parse(await req.json());

  // taxRateBps: basis points (e.g., 800 = 8%)
  const taxCents = Math.round(subtotalCents * taxRateBps / 10000);
  const totalCents = subtotalCents + taxCents + feesCents;

  await processPayment(totalCents); // use server-calculated total only
}

Never read totalCents, grandTotal, or equivalent fields from the request body when accepting payment.