A simple welcome page. You type your name, the page sends a request to the server, and the server answers with a greeting. The page always says you are a guest, and nothing in the interface changes that.
An intro welcome page in the Ravens world whose job is to teach you the request inspector at the bottom of the lab. You type your name and the page sends a request with role=guest always, and the server believes what arrives. Nothing in the page changes your role, but the request inspector lets you edit the request before resending it.
Make the server greet you as an admin, without changing the page itself.
A request carrying role=admin reaches the server.
Why the solution worked
The server believed the role value that arrived in the request. But the request is written by the client, and anyone with a tool that shows requests can write whatever they like in it. Hiding an option in the interface does not stop it from being sent.
The root cause
The server reads the role from the request itself, and the request is written by the client and can be edited. The root is trusting client input for an authorization decision.
How the code is fixed
The rule: everything that arrives in a request is untrusted input. Permissions are read from a session the server keeps, not from a value the client sends.
Vulnerable code
app.get('/hello', (req, res) => {
// The role comes straight from the request: the client decides who it is.
const role = req.query.role;
res.send(greeting(req.query.name, role));
});
Safe code
app.get('/hello', (req, res) => {
// The role comes from the server-side session, set at login. The request cannot change it.
const role = req.session.user?.role ?? 'guest';
res.send(greeting(req.query.name, role));
});
Impact in the real world
Trusting client-sent values for authorization allows role elevation and access to admin functions, the basis of many access-control bugs.
How defenders detect it
Defenders read permissions from the server session, not the request, and alert on requests carrying elevated roles from ordinary accounts.
