Burp Suite Interception

A proxy tool like Burp Suite sits between the browser and the server, letting an attacker (or a tester) forward, drop, or modify any request in flight. This is why server-side validation can never be optional.

Client-side validation is a UX convenience, not a security control

Any header, cookie, or body field can be freely rewritten in an intercepting proxy

The server must re-validate everything, exactly as if the browser weren't there

'Forward', 'Drop', and 'Modify & Forward' are the three fates of every intercepted request

Want this flow explained in detail as it plays?

POST/api/account/update-role

Headers

Host:app.flowground.dev

Content-Type:application/json

Cookie:session=eyJhbGciOi...redacted

Body

Quick-Insert Payloads

Defense in depth

Server-side authorization check: does the authenticated session actually have permission to grant "admin"?
Role changes require re-authentication or a step-up MFA challenge
All privilege changes are written to an immutable audit log with the actor's identity

Vulnerable vs. Fixed

// DO NOT DO THIS
app.post("/api/account/update-role", (req, res) => {
  const { userId, role } = req.body;
  db.users.update(userId, { role }); // no permission check
  res.json({ ok: true });
});