Is applyAttributeChange spoofable?

Functions
1

We use a Checkout UI Extension that calls applyAttributeChange to set a cart attribute. A Shopify Function then reads this attribute to apply a monetary discount.

Is this vulnerable to client-side spoofing? Can a user manually inject this attribute via the browser (AJAX) to trigger the discount bypassing the Extension?

If so, what is the secure best practice to pass trusted state from the Checkout UI to the Function?

2

As a rule of thumb, client’s cannot be trusted.

You have to either encrypt (but again if the keys are on the client, technically they can be compromised).

Or obfuscate via mapping to your discount via a UUID that has an extremely low chance of colliding or being guessed.

3

In addition to @Dylan’s point, cart attributes are user-editable. Both Storefront and AJAX APIs let buyers, themes, or scripts change them. Don’t use them for app state, pricing, or anything security‑sensitive.

Use app‑owned metafields instead:

  • Scoped to your app and write‑protected (only your app can mutate them).
  • Not modifiable from the storefront by customers or theme scripts.
  • Stable for storing configuration and state your app depends on.