Fix Business Logic Errors in SvelteKit

In SvelteKit, business logic vulnerabilities frequently manifest when developers conflate client-side state with server-side truth. Attackers exploit these gaps by intercepting Form Actions or API routes to manipulate parameters like prices, user IDs, or quantities that the server blindly trusts. To secure a SvelteKit app, you must treat all incoming request data as malicious and re-verify the application state against your database on every server-side execution.

The Vulnerable Pattern

export const actions = {
  checkout: async ({ request, locals }) => {
    const data = await request.formData();
    // VULNERABILITY: Trusting the client-calculated price and item list
    const totalPrice = data.get('total');
    const productId = data.get('pid');
await db.orders.create({
  userId: locals.user.id,
  amount: parseFloat(totalPrice),
  productId: productId
});

return { success: true };
}
};

The Secure Implementation

The vulnerable snippet suffers from Parameter Tampering. An attacker can modify the 'total' field in the POST request to $0.01 regardless of the actual product price. The secure implementation enforces the 'Server-Side Truth' pattern: it only accepts an identifier (pid) from the client, then fetches the price and availability directly from the database. In SvelteKit, always perform authorization and calculation within +page.server.js or +server.js using trusted data, treating the formData() only as a set of suggestions, not facts.

export const actions = {
  checkout: async ({ request, locals }) => {
    const data = await request.formData();
    const productId = data.get('pid');
// SECURE: Fetch product from DB to get the authoritative price
const product = await db.products.findUnique({ where: { id: productId } });

if (!product) throw error(404, 'Product not found');
if (product.stock <= 0) throw error(400, 'Out of stock');

// SECURE: Server-side calculation ignores client-provided 'total'
const actualTotal = product.price;

await db.orders.create({
  userId: locals.user.id,
  amount: actualTotal,
  productId: productId
});

return { success: true };
}
};