E-commerce security — PCI scope minimization + cart-tampering + BOLA on order routes
E-commerce security has a payment-card layer (PCI-DSS) and a non-payment layer (auth, BOLA, fraud). Most modern e-commerce uses Stripe / Shop Pay / Apple Pay tokenization to stay PCI SAQ A.
Top security risks
Cart tampering
Client-side price comparison + server-side trust on the client-supplied total = attacker pays $1 for a $1000 product. Always recompute totals server-side.
BOLA on /orders/[id]
Most common e-commerce data leak — orders accessible by ID without ownership check.
Credential stuffing
Customer accounts attacked with leaked credentials from elsewhere. Rate limiting + MFA + impossible-travel detection.
Coupon abuse + fraud
Single-use coupons reused, gift-card balances enumerated, refund fraud.
Regulatory context
PCI-DSS (payment cards), GDPR (EU users), CCPA (California users), state breach notification laws.
Checklist
- Stripe-class tokenization (SAQ A scope)
- Server-side total recomputation
- BOLA scan on every order route
- MFA + rate limiting on customer accounts
- Coupon single-use enforcement
- Refund-flow audit trail
B2C e-commerce buyers (you, the consumer) signal trust via 'Reviewed by Securie' badges + Verified-by-Visa-class indicators + clear privacy policy + visible MFA option.