Verify the checkout_id?

[osseonews]

When you create a cart for a customer on the frontend, the API generates a checkout_id in the cart. Is there a way to verify this checkout_id on the backend? Our use case is that we need to send the cart to a serverless function to do some backend work, and we want to verify the cart on the function before proceeding. Verifying the checkout_id seems to be the best option. But, what backend API function can we use to verify the checkout_id that is accurate etc?

[cachila]

Hello @osseonews,

You could check that using the backend API by running swell.get("/carts", {"checkout_id": "xyz"})

Is there anything else I can help you with?

[osseonews]

Ha, yeah, of course I can get the checkout_id. But that doesn't verify anything. The client can manipulate the cart by updating it. My question is: how do you verify the checkout_id? I assume this is some sort of hash, and I'm asking if there is any function that will verify the checkout_id, to ensure that it is accurate.

[ericingram]

Checkout ID is a randomly generated number (128 chars) which is then run through md5(). What kind of verification are you looking to do beyond that?

[osseonews]

I am looking for a way to verify a cart in a serverless function. As a client can manipulate the cart, by updating it, including it seems to set your own checkout_id? (is this accurate: swell.cart.update({}), how can you ever know if a cart that is sent to server is actually not been tampered with in the client? I figured there was some sort of hash that would verify it as the client couldn't hash it correctly without a secret. Hope that makes sense.

[ericingram]

It shouldn't be possible to update checkout_id using the frontend API (swell.js)

How is the serverless function being called?