BUILD OS · REUSABLE RULE
The server is the source of truth for access and payment state
Rule
The browser may request or display a state change; only a verified server-side operation should authorize durable access.
Why it matters
Client state can be edited, replayed or reached without the expected navigation. Server-owned state gives authorization a stable value to check.
Failure mode
A success page or client flag grants access that disagrees with payment, cancellation or account ownership.
Implementation
- Verify provider events before processing.
- Map external customer identifiers to accounts using server-owned records.
- Persist idempotent state transitions.
- Have protected reads check the durable state on the server or database.
Verification
- Directly visit the success URL without a paid event.
- Replay the same provider event.
- Change client-supplied account and product identifiers.
- Confirm access after a fresh session and after relevant cancellation or refund events.
Evidence and provenance
DocumentéThe billing field note documents this rule and links to the Stripe flow article; it does not claim a measured incident count.
Source updated 2026-09-26: published field note.