Fix Business Logic Errors in Express
Business logic errors are the silent killers of Express applications. Unlike SQLi or XSS, they don't trigger WAF signatures because they reside in the 'how' the app functions rather than the 'what' it processes. If your backend trusts the frontend to calculate totals, define user roles, or manage state transitions, you are already pwned. As a researcher, I look for the 'gap' between developer assumptions and reality.
The Vulnerable Pattern
app.post('/api/checkout', (req, res) => {
const { cartItems, totalPrice, userId } = req.body;
// VULNERABILITY: Trusting the client-side calculated price.
// An attacker can intercept this request and change totalPrice to 0.01.
db.orders.create({
items: cartItems,
amount: totalPrice,
user: userId
});
res.status(200).json({ message: 'Order processed' });
});The Secure Implementation
The vulnerability is a classic 'Parameter Manipulation' flaw. The server assumes the client is honest about the price. To fix this, you must treat all client input as malicious. 1) Never accept sensitive values like prices or roles from the request body. 2) Re-calculate all logic on the server using trusted database values. 3) Use session-based identity (e.g., req.user) instead of user-supplied IDs to prevent Insecure Direct Object References (IDOR). 4) Implement strict state-machine logic to ensure users cannot skip payment steps or reuse one-time discount codes.
app.post('/api/checkout', async (req, res) => { const { cartItems } = req.body; const userId = req.user.id; // Get ID from verified JWT/session, not bodytry { let calculatedTotal = 0; // SECURE: Re-calculate total based on DB ‘source of truth’ for (const item of cartItems) { const product = await db.products.findOne({ _id: item.id }); if (!product) throw new Error(‘Invalid product’); calculatedTotal += product.price * item.quantity; }
const order = await db.orders.create({ items: cartItems, amount: calculatedTotal, user: userId, status: 'PENDING_PAYMENT' }); res.status(200).json({ orderId: order._id, total: calculatedTotal });
} catch (err) { res.status(400).json({ error: ‘Checkout failed’ }); } });
Your Express API
might be exposed to Business Logic Errors
74% of Express apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.