Bypassing client-side controls - Port Swigger
Summary: PortSwigger Research describes how applications that rely on client-side measures to control submitted data leave significant security flaws, because the user has full control over the client. The article walks through using Burp Proxy and Burp Repeater to intercept a request, edit a hidden price parameter, and forward the modified data to the server, using the lab Excessive trust in client-side controls as the example.
Bottom line: A hidden price field in a request is editable by anyone with an intercepting proxy, so any validation that lives only in the browser is not validation at all - the server has to enforce it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026