title: PayPal Checkout: Is it safe to receive a payment with only client-side code?
body: <p>I'm using the PayPal API to put payment options to my website. <a href="https://developer.paypal.com/docs/checkout/integrate/" rel="noreferrer">In the tutorial they have</a>, they are rendering the button and setting up the transaction entirely at the client side with JavaScript. Here is the sample code:</p>
  <pre><code>&lt;script&gt;
    paypal.Buttons({
      createOrder: function(data, actions) {
        // This function sets up the details of the transaction, including the amount and line item details.
        return actions.order.create({
          purchase_units: [{
            amount: {
              value: '0.01'
            }
          }]
        });
      },
      onApprove: function(data, actions) {
        // This function captures the funds from the transaction.
        return actions.order.capture().then(function(details) {
          // This function shows a transaction success message to your buyer.
          alert('Transaction completed by ' + details.payer.name.given_name);
        });
      }
    }).render('#paypal-button-container');
    //This function displays Smart Payment Buttons on your web page.
  &lt;/script&gt;
  </code></pre>
  <p>Is this secure?</p>
  <p>The user can just change the payment amount in the code on his side and pay less. Even if I set up client-side code to send transaction-id once the transaction is successful (ie. make a POST request at onApprove), so that I can have a server-side code check if the amount sent is correct, the client can still change the code on his side to send a fake transaction-id.</p>
  <p>I basically need a mechanism to check if I definitely received the right amount, before delivering the product. I obviously need to make this check at the server-side but I can't figure out a secure way to do it because I need to get <em>some</em> info from the client-side which might be fake. How do I prevent the user from pretending to have paid for example by sending a past transaction-id?</p>