Fix Business Logic Errors in Tide

Business logic errors are the 'silent killers' of Tide applications. Unlike common injection flaws, these vulnerabilities exist in the application's design and flow. They occur when the backend assumes the client will always behave, allowing attackers to manipulate state transitions, bypass payment gateways, or escalate privileges by subverting the intended workflow. To fix them, you must stop trusting client-provided metadata and enforce strict server-side state machines.

The Vulnerable Pattern

public function applyDiscount(Request $request) {
    $order = Order::find($request->order_id);
    $discountAmount = $request->discount_amount; // Vulnerability: Trusting client-side calculation
$order->total = $order->total - $discountAmount;
$order->save();
return response()->json(['status' => 'success', 'new_total' => $order->total]);
}

The Secure Implementation

The vulnerable snippet suffers from two critical logic flaws: Parameter Tampering and IDOR. It trusts the 'discount_amount' sent by the user, allowing an attacker to set an arbitrary price (even negative). It also lacks ownership checks on the 'order_id'. The secure implementation fixes this by: 1. Using session-bound ownership (Auth::user()) to ensure users only modify their own orders. 2. Moving the discount calculation entirely to the server-side logic based on a validated coupon code. Never let the client define the 'price', 'quantity', or 'role' in a transaction.

public function applyDiscount(Request $request) {
    $request->validate(['coupon_code' => 'required|string']);
    $order = Auth::user()->orders()->findOrFail($request->order_id); // Fix 1: Prevent IDOR
$coupon = Coupon::where('code', $request->coupon_code)->firstOrFail();
if (!$coupon->isValidFor($order)) {
    return response()->json(['error' => 'Invalid coupon'], 422);
}

// Fix 2: Server-side calculation only
$discountAmount = $coupon->calculateDiscount($order->subtotal);
$order->total = $order->subtotal - $discountAmount;
$order->save();

return response()->json(['status' => 'success', 'new_total' => $order->total]);
}