A huge security hole in OrdersController

[ghost]

In OrdersController - InitOrder I can pass any product price, different than a real product price and your application accepts it. There is no validation.

[oskardudycz]

It’s intended, as Orders API should only be used internally through the Saga. It should use the frozen price the consumer confirmed in the shopping cart.
Do you have a recommendation on how you would implement that differently?

[oskardudycz]

Closing it for now, with the justification as above. I'm willing to reopen it after the feedback.