A transit multi-step checkout accepts the price totals submitted from the browser on step 3. What should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Letting the browser tell the cashier how much to charge is like letting the customer write the receipt. Multi-step checkouts that trust client price fields are classic business-logic trust failures. Hide the field, switch to POST, or bolt on a WAF — none of that replaces server-side recomputation.
Full Explanation
Applications must derive prices, discounts, and authorization decisions on the server using authoritative data, not client-submitted totals. UI affordances and HTTP method choice do not make parameters trustworthy. WAFs rarely catch logic-parameter abuse. Testers should document client-trusted financial fields as business-logic findings and recommend server-side recomputation with integrity checks across checkout steps.