Re:Stealing $20M Worth of Magic: The Gathering Cards in a Si...
by dontlaugh on Friday May 05, 2023 @07:31AM
(#35827893)
There are other ways to do this, but not necessarily simpler:
- explicitly version every change to the store catalogue and require the version to be passed with a purchase, disallowing purchases from old catalogues
- make an expiring signed piece of data (like JWT) for each offer in the store catalogue and require it to be passed back with a purchase, accepting old prices briefly
- make the purchase API two-phase, locking in the price on the first phase and letting the client notice that it changed and potentially neglect to go through with the second phase
- explicitly version every change to the store catalogue and require the version to be passed with a purchase, disallowing purchases from old catalogues
- make an expiring signed piece of data (like JWT) for each offer in the store catalogue and require it to be passed back with a purchase, accepting old prices briefly
- make the purchase API two-phase, locking in the price on the first phase and letting the client notice that it changed and potentially neglect to go through with the second phase