How dangerous is it to pass Private Cart Attributes for use in a Shopify Function

Hey everyone, I’m currently building my first Shopify app and I decided to build a bundle builder because it seemed like the most straightforward thing to build at the time.

The app allows for merchants to set up a mix and match bundle where customers can freely choose which items to add to their bundle and they get discounts as they add more items.

I’ve set up a Shopify Function to bundle products under a single parent product and apply a discount and it works! I’m using a private cart attribute to pass discount data to the function and private line item attributes to group the bundled products.

I have a question about the safety and viability of my current approach.

I recall reading in the documentation that storing data in cart attributes might not be the most secure method. However, the documentation also suggests that private cart attributes can’t be updated via the Shopify Cart API. I’d like to confirm if this is true and if my strategy is a safe way to proceed.

I found a different post in the Shopify Community forum where someon was asking a similar question but the approach that was recommended won’t work for me.

I know that I could use metafields to store and access this data. However, that approach seems to add a lot of overhead and I didn’t want to deal with that.

Is my current approach acceptable? Am I creating a potential problem by relying on private attributes in this way? Any insights or suggestions would be greatly appreciated!

Thanks!

Private cart attributes can be set via the Cart API, ultimately making them not secure. Anyone can make a request and modify these.

Hey @Luke thanks for your response.
Is there anyway to do this without having to use metafields?
I saw in another post people recommended doing something called HMAC signing but I can’t do that because I would have to make a request to backend from an App Proxy on the Shopify Store that has installed the app.

Not that I’m aware of, the whole point of the app proxy is to ensure the data is sent securely and then used in your function. Anything else would just be exposed.