Question 1

What is HTTP Parameter Pollution?

Accepted Answer

HTTP Parameter Pollution (HPP) supplies the same query or body parameter more than once — for example ?role=user&role=admin. Different components (WAF, framework, backend) disagree on which occurrence wins: some take the first, some the last, some concatenate. That disagreement lets an attacker satisfy a security check with one value while the business logic acts on another.

Question 2

How does it bypass an access check?

Accepted Answer

If a validator reads the first occurrence of role (user) and passes the request, but the backend reads the last occurrence (admin) and applies it, the attacker escalates privileges even though every layer 'saw' a legitimate value. The same trick can smuggle a small amount past a price check while charging or refunding a different one.

Question 3

How do I prevent parameter pollution?

Accepted Answer

Reject requests containing duplicate keys, or canonicalize to a single value before any validation runs, and make sure the security check and the business logic read the exact same parsed variable. Configure the proxy, WAF, and application framework to use identical parameter-parsing semantics so no desync exists.

HTTP Parameter Pollution

Challenges

Frequently Asked Questions