Fix Business Logic Errors in Fresh

Fresh's architecture relies on Handlers for server-side logic and Islands for client-side interactivity. A common business logic failure in this ecosystem is 'State Injection' or 'Parameter Manipulation'—where the developer trusts data sent from an Island to a Handler. If your Deno edge functions process transactions, permissions, or sensitive state based solely on client-provided values without server-side re-validation, the application is fundamentally broken.

The Vulnerable Pattern

export const handler: Handlers = {
  async POST(req, _ctx) {
    const { productId, price, quantity } = await req.json();
    // VULNERABILITY: The handler trusts the 'price' sent from the client-side Island.
    // An attacker can modify the fetch request in the browser to set price: 0.01.
    const transaction = await db.orders.create({
      productId,
      amount: price * quantity,
      status: 'pending'
    });
    return new Response(JSON.stringify(transaction), { status: 201 });
  }
};

The Secure Implementation

The exploit vector targets the trust boundary between the Preact Island (client) and the Fresh Handler (server). In the vulnerable snippet, the server assumes the client is honest about the price. A researcher can use the browser console or a proxy like Burp Suite to inject a lower price. The secure implementation treats the client input as untrusted 'intent' and resolves critical business data (like price) using a server-side lookup. Always implement 'Server-Side Authority'—the client should only provide the minimum necessary identifiers (IDs and quantities), while the server dictates the logic and costs.

export const handler: Handlers = {
  async POST(req, _ctx) {
    const { productId, quantity } = await req.json();
// SECURE: Fetch the source of truth from the database, ignore client-provided pricing.
const product = await db.products.findFirst({ where: { id: productId } });

if (!product || quantity <= 0) {
  return new Response("Invalid request", { status: 400 });
}

const totalAmount = product.price * quantity;

const transaction = await db.orders.create({
  productId,
  amount: totalAmount,
  status: 'pending'
});

return new Response(JSON.stringify(transaction), { status: 201 });
}
};