Practice Log 03: Client-Controlled Roles and Server-Side Permission

I completed PortSwigger’s User role controlled by request parameter lab on October 26 as part of my PWPA preparation.

I logged in with the provided lab account and used Burp to inspect intercepted requests. I noticed a cookie carrying administrative role information. I repeatedly edited that data on intercepted requests to gain access to the admin panel and complete the lab.

Authentication establishes who is making a request. Authorization determines what that identity may do.

A role claim sent by the browser is client-controlled input; therefore, the server needs a trusted basis for deciding whether the requested action is allowed.

Trusting an editable role claim can let a user perform actions outside their assigned permissions.

Afterward, I watched Rana Khalil’s walkthrough. Her approach used Repeater alongside a change to the browser’s cookie state through developer tools.

Changing browser state seemed like the easier approach in retrospect rather than editing every intercepted request.

Burp Repeater supports sending and comparing individual requests without repeating the browser interaction. Changing a cookie stored in the browser can affect subsequent matching browser requests while that value remains in place.

Those are different scopes of change, even when they explore the same permission boundary.

As general practice, useful evidence would connect the authenticated identity, the changed client input, and the resulting restricted action, with credentials and session data redacted.

A fix should derive permissions from trusted server-side data and enforce them on every protected request.

Regression checks should verify that altered or missing role data cannot grant extra permission, that a denied action leaves state unchanged, and that authorized use still works.

If you try the exercise, use PortSwigger’s authorized training environment and stay within its scope.

Practice the lab · Read OWASP’s authorization guidance · Rana Khalil's Walkthrough