Amount changed in Javascript SDK security issue

Question

I was working on PayPal gateway integeration on my website using Javascript SDK and then I came up with this thought that, what if someone changes the value of amount in the code below through selenium or directly injecting Javascript? Is it possible?

paypal.Buttons({
  createOrder: function(data, actions) {
    // This function sets up the details of the transaction, including the amount and line item details.
    return actions.order.create({
      purchase_units: [{
        amount: {
          value: '0.01'
        }
      }]
    });
  },

  onApprove: function(data, actions) {
    // This function captures the funds from the transaction.
    return actions.order.capture().then(function(details) {
      // This function shows a transaction success message to your buyer.
      alert('Transaction completed by ' + details.payer.name.given_name);
    });
  }
}).render('#paypal-button-container');

//This function displays payment buttons on your web page.

Answer 1

Yes, a malicious user can modify any value or outright spoof any operations that a web page's script knows/can perform. It is possible with careful use of JS scopes to hide variables from casual user access, but it's not possible to then use those values to do things such as make a request without the user being able to view, and tamper with, those variables (for example, the user can use the JS debugger to access local variables even within a closure not visible from the global scope). The only things that can be stored in JS in a way totally invisible to the user are cryptographic keys, and a malicious user can still instruct the browser to use those despite not knowing their values.

This is why it is critical that you never trust the client. You must verify - on your back-end server - that the PayPal transaction was the expected amount. Don't rely on the client relaying the amount to the server (unless the proof of purchase is cryptographically signed by PayPal and you can verify the signature) as an attacker can of course spoof that too. Any kinds of security-relevant checks that the client makes can only be considered a user convenience and purely advisory; the actual determination of whether the user did the right thing can only be made on the server (where the user lacks control of the execution).